Crypto-Ransomware : Your Crippling Information Technology Nightmare
Ransomware Recovery ProfessionalsRansomware has become a modern cyberplague that represents an extinction-level danger for businesses poorly prepared for an assault. Versions of ransomware such as Reveton, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been replicating for years and still cause destruction. Newer variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, plus daily unnamed viruses, not only encrypt online data files but also infect many configured system backup. Files synchronized to cloud environments can also be corrupted. In a poorly designed environment, this can render automatic recovery useless and basically knocks the entire system back to zero.

Getting back applications and information after a crypto-ransomware attack becomes a race against the clock as the targeted organization tries its best to stop lateral movement, remove the crypto-ransomware, and resume business-critical activity. Because ransomware needs time to replicate throughout a targeted network, penetrations are frequently launched on weekends, when attacks in many cases take longer to recognize. This multiplies the difficulty of rapidly assembling and orchestrating a qualified response team.

Progent has an assortment of help services for protecting San Antonio businesses from ransomware penetrations. Among these are staff education to help recognize and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat defense to identify and disable zero-day modern malware attacks. Progent also provides the services of seasoned ransomware recovery professionals with the talent and commitment to reconstruct a compromised environment as soon as possible.

Progent's Ransomware Recovery Help
Following a crypto-ransomware invasion, even paying the ransom demands in cryptocurrency does not ensure that cyber criminals will respond with the needed keys to unencrypt any or all of your data. Kaspersky ascertained that 17% of ransomware victims never recovered their information after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The fallback is to setup from scratch the critical elements of your IT environment. Without access to complete system backups, this calls for a wide complement of skills, top notch project management, and the ability to work non-stop until the job is complete.

For twenty years, Progent has provided expert IT services for companies throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have been awarded top industry certifications in foundation technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security consultants have garnered internationally-renowned industry certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in financial systems and ERP software solutions. This breadth of experience gives Progent the ability to rapidly ascertain necessary systems and organize the remaining parts of your computer network environment after a ransomware penetration and rebuild them into a functioning system.

Progent's recovery team of experts deploys top notch project management systems to coordinate the complicated recovery process. Progent appreciates the importance of working quickly and in concert with a client's management and Information Technology staff to assign priority to tasks and to put the most important systems back online as fast as humanly possible.

Client Story: A Successful Crypto-Ransomware Incident Restoration
A client escalated to Progent after their network was attacked by the Ryuk crypto-ransomware. Ryuk is believed to have been deployed by North Korean government sponsored hackers, suspected of using techniques leaked from the U.S. NSA organization. Ryuk attacks specific organizations with limited ability to sustain disruption and is among the most profitable iterations of ransomware viruses. Well Known victims include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing company located in the Chicago metro area with about 500 workers. The Ryuk intrusion had frozen all essential operations and manufacturing capabilities. Most of the client's data backups had been online at the beginning of the intrusion and were eventually encrypted. The client was actively seeking loans for paying the ransom (more than two hundred thousand dollars) and hoping for the best, but in the end made the decision to use Progent.

"I can't tell you enough about the support Progent gave us throughout the most stressful time of (our) company's survival. We most likely would have paid the criminal gangs if it wasn't for the confidence the Progent team afforded us. The fact that you could get our messaging and key servers back into operation in less than 1 week was amazing. Each expert I talked with or communicated with at Progent was laser focused on getting us operational and was working breakneck pace on our behalf."

Progent worked with the customer to quickly understand and prioritize the critical services that had to be addressed to make it possible to continue company operations:

  • Active Directory (AD)
  • Microsoft Exchange
  • MRP System
To start, Progent adhered to Anti-virus event mitigation industry best practices by halting lateral movement and clearing up compromised systems. Progent then initiated the steps of rebuilding Microsoft AD, the core of enterprise networks built on Microsoft Windows Server technology. Microsoft Exchange email will not function without Windows AD, and the client's financials and MRP system leveraged Microsoft SQL, which depends on Windows AD for authentication to the database.

Within 2 days, Progent was able to restore Active Directory to its pre-attack state. Progent then completed rebuilding and storage recovery of essential systems. All Microsoft Exchange Server schema and configuration information were intact, which facilitated the restore of Exchange. Progent was able to collect non-encrypted OST data files (Microsoft Outlook Offline Folder Files) on staff PCs and laptops to recover email data. A not too old offline backup of the customer's manufacturing software made them able to restore these vital programs back on-line. Although a large amount of work needed to be completed to recover completely from the Ryuk attack, the most important systems were recovered rapidly:

"For the most part, the production manufacturing operation did not miss a beat and we delivered all customer sales."

Throughout the following couple of weeks critical milestones in the restoration project were achieved in close collaboration between Progent engineers and the client:

  • Self-hosted web sites were restored without losing any data.
  • The MailStore Server exceeding four million historical messages was restored to operations and accessible to users.
  • CRM/Customer Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory functions were 100 percent restored.
  • A new Palo Alto 850 security appliance was brought on-line.
  • Most of the user desktops were fully operational.
"A lot of what occurred that first week is nearly entirely a fog for me, but my management will not soon forget the care each of you accomplished to give us our company back. I have utilized Progent for the past ten years, possibly more, and every time Progent has come through and delivered as promised. This event was a testament to your capabilities."

Conclusion
A probable business-ending catastrophe was averted by hard-working professionals, a broad spectrum of technical expertise, and tight collaboration. Although in analyzing the event afterwards the ransomware virus penetration described here should have been identified and blocked with advanced security technology and NIST Cybersecurity Framework best practices, team training, and properly executed incident response procedures for information backup and proper patching controls, the reality is that government-sponsored criminal cyber gangs from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware incursion, remember that Progent's roster of professionals has a proven track record in crypto-ransomware virus blocking, cleanup, and data disaster recovery.

"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Arnaud, Allen, Tony and Chris (along with others that were involved), thank you for letting me get rested after we got past the initial fire. Everyone did an amazing job, and if any of your guys is around the Chicago area, dinner is on me!"

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this customer story, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in San Antonio
For ransomware cleanup services in the San Antonio metro area, call Progent at 800-462-8800 or go to Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.