Ransomware : Your Feared IT Disaster
Crypto-Ransomware Recovery ExpertsCrypto-Ransomware has become a too-frequent cyberplague that represents an enterprise-level danger for businesses unprepared for an assault. Different versions of ransomware like the CrySIS, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been replicating for many years and still cause harm. More recent variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Egregor, along with frequent unnamed malware, not only encrypt on-line data but also infect many available system protection mechanisms. Data synched to cloud environments can also be encrypted. In a vulnerable environment, it can render automated restoration useless and effectively sets the entire system back to zero.

Getting back on-line applications and data following a crypto-ransomware outage becomes a sprint against the clock as the victim tries its best to stop lateral movement, clear the ransomware, and restore business-critical activity. Due to the fact that crypto-ransomware requires time to spread across a targeted network, penetrations are usually sprung on weekends and holidays, when attacks typically take longer to notice. This compounds the difficulty of rapidly assembling and coordinating a capable response team.

Progent offers a range of help services for securing St. Louis businesses from ransomware penetrations. Among these are team training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based threat protection to detect and quarantine day-zero modern malware assaults. Progent in addition can provide the services of veteran crypto-ransomware recovery engineers with the track record and perseverance to re-deploy a compromised system as quickly as possible.

Progent's Ransomware Restoration Support Services
Soon after a crypto-ransomware penetration, sending the ransom demands in cryptocurrency does not guarantee that cyber criminals will return the keys to decrypt all your files. Kaspersky Labs ascertained that 17% of crypto-ransomware victims never recovered their files after having paid the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The other path is to setup from scratch the mission-critical parts of your IT environment. Without access to essential system backups, this requires a wide range of skill sets, professional team management, and the capability to work non-stop until the job is completed.

For two decades, Progent has offered expert IT services for businesses throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have been awarded top industry certifications in foundation technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have garnered internationally-renowned certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience with accounting and ERP applications. This breadth of expertise gives Progent the ability to efficiently understand important systems and organize the surviving parts of your IT system after a ransomware attack and configure them into a functioning network.

Progent's recovery team of experts deploys best of breed project management systems to coordinate the sophisticated recovery process. Progent understands the importance of working rapidly and in unison with a client's management and Information Technology resources to assign priority to tasks and to put the most important services back on-line as soon as possible.

Customer Story: A Successful Ransomware Attack Recovery
A small business escalated to Progent after their network was crashed by the Ryuk crypto-ransomware. Ryuk is generally considered to have been developed by North Korean government sponsored hackers, possibly using algorithms exposed from the United States NSA organization. Ryuk targets specific businesses with little tolerance for operational disruption and is one of the most profitable examples of crypto-ransomware. Major victims include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturing business based in Chicago with around 500 workers. The Ryuk intrusion had paralyzed all company operations and manufacturing capabilities. The majority of the client's system backups had been directly accessible at the start of the intrusion and were encrypted. The client was evaluating paying the ransom (exceeding $200,000) and hoping for the best, but ultimately engaged Progent.

"I cannot speak enough in regards to the expertise Progent gave us throughout the most critical time of (our) company's survival. We most likely would have paid the cybercriminals if it wasn't for the confidence the Progent experts provided us. That you were able to get our messaging and production applications back on-line in less than 1 week was amazing. Each consultant I spoke to or e-mailed at Progent was amazingly focused on getting my company operational and was working at all hours to bail us out."

Progent worked with the client to rapidly determine and assign priority to the most important systems that had to be restored to make it possible to restart company functions:

  • Windows Active Directory
  • Electronic Mail
  • MRP System
To get going, Progent adhered to Anti-virus event mitigation best practices by halting the spread and cleaning systems of viruses. Progent then started the task of bringing back online Microsoft Active Directory, the key technology of enterprise environments built on Microsoft technology. Microsoft Exchange Server email will not function without AD, and the customer's financials and MRP system leveraged SQL Server, which needs Active Directory services for access to the data.

Within 2 days, Progent was able to rebuild Active Directory to its pre-attack state. Progent then performed reinstallations and storage recovery on key systems. All Microsoft Exchange Server data and configuration information were usable, which greatly helped the restore of Exchange. Progent was also able to find local OST files (Outlook Off-Line Data Files) on various PCs to recover mail data. A recent off-line backup of the businesses accounting/ERP systems made it possible to restore these vital applications back servicing users. Although a lot of work remained to recover fully from the Ryuk event, the most important systems were recovered rapidly:

"For the most part, the assembly line operation never missed a beat and we did not miss any customer orders."

Throughout the following couple of weeks important milestones in the restoration project were completed in close collaboration between Progent engineers and the customer:

  • In-house web applications were brought back up with no loss of information.
  • The MailStore Server with over 4 million historical messages was brought on-line and available for users.
  • CRM/Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory Control capabilities were completely operational.
  • A new Palo Alto Networks 850 security appliance was brought on-line.
  • Ninety percent of the user PCs were back into operation.
"Much of what happened those first few days is nearly entirely a haze for me, but my team will not soon forget the countless hours all of you put in to give us our business back. I've trusted Progent for the past ten years, maybe more, and every time Progent has impressed me and delivered as promised. This event was a Herculean accomplishment."

Conclusion
A likely business catastrophe was dodged through the efforts of results-oriented professionals, a wide spectrum of technical expertise, and close collaboration. Although in post mortem the crypto-ransomware attack described here should have been stopped with current security technology solutions and recognized best practices, team training, and appropriate security procedures for information backup and keeping systems up to date with security patches, the fact remains that state-sponsored hackers from Russia, China and elsewhere are relentless and represent an ongoing threat. If you do get hit by a crypto-ransomware incident, feel confident that Progent's roster of experts has proven experience in ransomware virus defense, cleanup, and data disaster recovery.

"So, to Darrin, Aaron, Dan, Claude, Jesse, Arnaud, Allen, Tony and Chris (along with others that were contributing), I'm grateful for allowing me to get rested after we got through the first week. All of you did an impressive job, and if any of your team is around the Chicago area, dinner is my treat!"

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting Services in St. Louis
For ransomware system restoration services in the St. Louis area, call Progent at 800-462-8800 or see Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.