Crypto-Ransomware : Your Crippling IT Disaster
Ransomware Recovery ExpertsCrypto-Ransomware has become an escalating cyberplague that presents an extinction-level threat for organizations unprepared for an attack. Different versions of ransomware such as Reveton, WannaCry, Locky, Syskey and MongoLock cryptoworms have been out in the wild for years and continue to inflict destruction. More recent versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, along with more unnamed malware, not only encrypt online data files but also infect any accessible system restores and backups. Information synchronized to cloud environments can also be ransomed. In a poorly architected data protection solution, this can render any restoration impossible and effectively sets the network back to square one.

Getting back applications and data after a crypto-ransomware attack becomes a race against the clock as the victim fights to stop the spread, eradicate the ransomware, and restore business-critical operations. Since ransomware takes time to replicate across a network, assaults are usually launched on weekends, when attacks may take longer to notice. This compounds the difficulty of promptly marshalling and orchestrating a qualified mitigation team.

Progent makes available an assortment of services for securing Santa Cruz organizations from crypto-ransomware attacks. Among these are staff training to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based threat defense to identify and quarantine day-zero malware attacks. Progent in addition provides the assistance of experienced ransomware recovery consultants with the skills and commitment to reconstruct a breached environment as rapidly as possible.

Progent's Ransomware Recovery Help
Subsequent to a crypto-ransomware penetration, sending the ransom in cryptocurrency does not ensure that cyber hackers will return the needed codes to decipher any of your data. Kaspersky estimated that 17% of ransomware victims never restored their information even after having paid the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The alternative is to piece back together the essential elements of your Information Technology environment. Absent the availability of full information backups, this calls for a broad complement of IT skills, well-coordinated project management, and the willingness to work non-stop until the recovery project is over.

For two decades, Progent has provided professional IT services for companies throughout the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have been awarded high-level industry certifications in key technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have garnered internationally-renowned certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise in financial management and ERP applications. This breadth of experience affords Progent the skills to efficiently identify critical systems and consolidate the remaining pieces of your IT environment following a ransomware penetration and assemble them into an operational network.

Progent's recovery group deploys top notch project management applications to orchestrate the sophisticated recovery process. Progent understands the urgency of working swiftly and in concert with a customer's management and IT team members to assign priority to tasks and to put key systems back on line as fast as possible.

Customer Case Study: A Successful Ransomware Virus Response
A business contacted Progent after their company was taken over by the Ryuk ransomware. Ryuk is believed to have been launched by North Korean state sponsored cybercriminals, possibly using strategies leaked from the U.S. National Security Agency. Ryuk seeks specific businesses with limited tolerance for disruption and is among the most lucrative incarnations of ransomware. High publicized targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturing company headquartered in the Chicago metro area and has about 500 employees. The Ryuk event had frozen all business operations and manufacturing processes. The majority of the client's system backups had been online at the beginning of the attack and were damaged. The client was taking steps for paying the ransom demand (exceeding two hundred thousand dollars) and wishfully thinking for good luck, but ultimately made the decision to use Progent.

"I cannot tell you enough about the support Progent provided us during the most critical time of (our) businesses survival. We had little choice but to pay the cyber criminals behind the attack if not for the confidence the Progent team afforded us. That you could get our messaging and key applications back online sooner than one week was something I thought impossible. Every single expert I interacted with or communicated with at Progent was amazingly focused on getting us restored and was working 24 by 7 to bail us out."

Progent worked with the client to rapidly identify and assign priority to the essential services that needed to be recovered to make it possible to continue departmental operations:

  • Windows Active Directory
  • Microsoft Exchange Server
  • Financials/MRP
To start, Progent followed Anti-virus event response best practices by stopping lateral movement and performing virus removal steps. Progent then began the steps of bringing back online Microsoft Active Directory, the foundation of enterprise systems built on Microsoft Windows technology. Exchange email will not function without AD, and the client's accounting and MRP software used SQL Server, which requires Active Directory services for security authorization to the database.

Within two days, Progent was able to restore Active Directory to its pre-intrusion state. Progent then performed reinstallations and storage recovery of key applications. All Exchange schema and configuration information were intact, which accelerated the restore of Exchange. Progent was also able to assemble intact OST files (Microsoft Outlook Offline Folder Files) on various workstations and laptops in order to recover email information. A recent offline backup of the businesses manufacturing software made it possible to restore these required applications back available to users. Although a lot of work needed to be completed to recover totally from the Ryuk attack, the most important services were restored rapidly:

"For the most part, the manufacturing operation was never shut down and we produced all customer sales."

During the next month key milestones in the recovery process were made through tight collaboration between Progent team members and the customer:

  • In-house web applications were restored with no loss of information.
  • The MailStore Server containing more than 4 million archived emails was brought online and accessible to users.
  • CRM/Product Ordering/Invoicing/Accounts Payable (AP)/AR/Inventory modules were fully operational.
  • A new Palo Alto 850 security appliance was brought online.
  • 90% of the user workstations were back into operation.
"A lot of what transpired those first few days is nearly entirely a fog for me, but we will not soon forget the dedication each of the team put in to help get our business back. I've trusted Progent for the past 10 years, maybe more, and each time Progent has come through and delivered as promised. This event was a testament to your capabilities."

Conclusion
A probable enterprise-killing disaster was averted due to dedicated experts, a broad spectrum of subject matter expertise, and close collaboration. Although upon completion of forensics the ransomware incident detailed here would have been disabled with up-to-date security technology solutions and best practices, staff training, and well thought out incident response procedures for data backup and proper patching controls, the fact is that government-sponsored cyber criminals from Russia, China and elsewhere are relentless and are not going away. If you do get hit by a crypto-ransomware incursion, feel confident that Progent's roster of experts has proven experience in ransomware virus defense, cleanup, and file recovery.

"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Arnaud, Allen, Tony and Chris (and any others that were contributing), thank you for allowing me to get rested after we made it over the most critical parts. Everyone did an amazing effort, and if any of your team is visiting the Chicago area, dinner is my treat!"

Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this customer case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting Services in Santa Cruz
For ransomware recovery expertise in the Santa Cruz metro area, phone Progent at 800-462-8800 or go to Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.