Crypto-Ransomware : Your Worst Information Technology Catastrophe
Crypto-Ransomware Remediation ConsultantsRansomware has become a too-frequent cyberplague that poses an enterprise-level danger for businesses poorly prepared for an assault. Multiple generations of ransomware such as Reveton, Fusob, Locky, NotPetya and MongoLock cryptoworms have been replicating for a long time and continue to cause damage. Newer versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, along with frequent unnamed viruses, not only perform encryption of on-line critical data but also infect all available system restores and backups. Data replicated to off-premises disaster recovery sites can also be rendered useless. In a vulnerable system, this can render automated recovery hopeless and basically knocks the entire system back to square one.

Getting back programs and data after a ransomware event becomes a sprint against the clock as the victim tries its best to stop lateral movement, cleanup the ransomware, and restore enterprise-critical operations. Since ransomware needs time to replicate throughout a targeted network, attacks are usually launched during nights and weekends, when successful attacks are likely to take more time to identify. This compounds the difficulty of quickly marshalling and coordinating a capable mitigation team.

Progent provides an assortment of services for securing Pleasanton businesses from ransomware attacks. These include user training to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat protection to discover and suppress zero-day malware attacks. Progent also can provide the services of experienced ransomware recovery professionals with the skills and commitment to re-deploy a compromised environment as quickly as possible.

Progent's Ransomware Recovery Services
Subsequent to a ransomware attack, paying the ransom demands in cryptocurrency does not provide any assurance that criminal gangs will respond with the keys to decipher any or all of your files. Kaspersky Labs determined that 17% of crypto-ransomware victims never recovered their information even after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The other path is to re-install the critical elements of your IT environment. Absent access to full system backups, this requires a broad range of skill sets, professional team management, and the capability to work continuously until the task is finished.

For decades, Progent has provided certified expert IT services for businesses throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have been awarded advanced industry certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have earned internationally-renowned industry certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise in financial management and ERP software solutions. This breadth of expertise gives Progent the capability to quickly identify important systems and organize the remaining components of your computer network system following a ransomware event and assemble them into a functioning system.

Progent's ransomware team of experts deploys top notch project management tools to orchestrate the sophisticated recovery process. Progent understands the importance of working swiftly and in unison with a client's management and Information Technology team members to prioritize tasks and to get the most important systems back on-line as soon as humanly possible.

Client Story: A Successful Crypto-Ransomware Virus Response
A small business hired Progent after their company was brought down by Ryuk ransomware. Ryuk is thought to have been developed by North Korean government sponsored criminal gangs, possibly adopting approaches leaked from the U.S. NSA organization. Ryuk goes after specific businesses with limited tolerance for operational disruption and is one of the most profitable iterations of crypto-ransomware. High publicized victims include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturing business based in Chicago with about 500 workers. The Ryuk attack had shut down all business operations and manufacturing capabilities. The majority of the client's data protection had been online at the time of the attack and were destroyed. The client was pursuing financing for paying the ransom demand (in excess of $200K) and hoping for good luck, but in the end utilized Progent.

"I can't thank you enough in regards to the care Progent gave us during the most stressful time of (our) company's survival. We most likely would have paid the cybercriminals if it wasn't for the confidence the Progent team provided us. That you were able to get our e-mail system and production applications back on-line quicker than seven days was something I thought impossible. Each staff member I worked with or messaged at Progent was urgently focused on getting our company operational and was working breakneck pace on our behalf."

Progent worked with the client to rapidly determine and prioritize the mission critical areas that had to be restored to make it possible to continue departmental operations:

  • Windows Active Directory
  • Microsoft Exchange Email
  • Accounting/MRP
To begin, Progent adhered to ransomware incident response industry best practices by stopping lateral movement and removing active viruses. Progent then started the process of bringing back online Microsoft Active Directory, the heart of enterprise networks built upon Microsoft Windows Server technology. Microsoft Exchange email will not work without Active Directory, and the client's financials and MRP software utilized Microsoft SQL Server, which needs Active Directory services for security authorization to the database.

In less than 48 hours, Progent was able to recover Windows Active Directory to its pre-virus state. Progent then initiated reinstallations and hard drive recovery of critical systems. All Exchange Server data and attributes were intact, which facilitated the restore of Exchange. Progent was able to locate intact OST data files (Microsoft Outlook Off-Line Data Files) on team PCs in order to recover mail information. A not too old off-line backup of the customer's financials/ERP software made them able to return these essential programs back available to users. Although a large amount of work was left to recover fully from the Ryuk event, critical systems were returned to operations quickly:

"For the most part, the assembly line operation ran fairly normal throughout and we made all customer sales."

Throughout the following couple of weeks key milestones in the restoration project were achieved through tight collaboration between Progent team members and the customer:

  • In-house web sites were brought back up with no loss of data.
  • The MailStore Server with over 4 million historical emails was brought on-line and available for users.
  • CRM/Product Ordering/Invoicing/Accounts Payable/AR/Inventory Control capabilities were 100 percent recovered.
  • A new Palo Alto 850 security appliance was brought on-line.
  • Nearly all of the user PCs were being used by staff.
"Much of what happened during the initial response is nearly entirely a haze for me, but my team will not forget the countless hours each and every one of the team put in to help get our business back. I have entrusted Progent for at least 10 years, maybe more, and each time Progent has impressed me and delivered. This time was a stunning achievement."

Conclusion
A likely company-ending catastrophe was averted through the efforts of dedicated experts, a wide spectrum of IT skills, and tight teamwork. Although in post mortem the ransomware attack described here could have been disabled with up-to-date security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team training, and well designed security procedures for data protection and proper patching controls, the reality is that state-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware attack, remember that Progent's roster of professionals has extensive experience in ransomware virus defense, cleanup, and file recovery.

"So, to Darrin, Matt, Aaron, Dan, Jesse, Arnaud, Allen, Tony and Chris (and any others who were contributing), thank you for letting me get rested after we got through the most critical parts. All of you did an fabulous job, and if anyone is in the Chicago area, a great meal is my treat!"

Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Expertise in Pleasanton
For ransomware recovery expertise in the Pleasanton metro area, call Progent at 800-462-8800 or see Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.