Ransomware : Your Worst Information Technology Catastrophe
Ransomware Remediation ExpertsCrypto-Ransomware has become an escalating cyber pandemic that poses an existential danger for businesses unprepared for an attack. Different iterations of ransomware such as Reveton, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been around for years and continue to cause havoc. Newer versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, plus daily unnamed viruses, not only perform encryption of on-line data files but also infect many available system protection mechanisms. Files synched to off-premises disaster recovery sites can also be ransomed. In a poorly architected system, this can render automated recovery useless and effectively knocks the entire system back to zero.

Getting back on-line applications and information following a ransomware intrusion becomes a race against the clock as the targeted organization struggles to stop lateral movement, clear the ransomware, and restore mission-critical activity. Due to the fact that crypto-ransomware needs time to move laterally throughout a network, assaults are often sprung at night, when penetrations typically take longer to identify. This multiplies the difficulty of rapidly assembling and orchestrating a knowledgeable response team.

Progent offers a variety of solutions for securing Vacaville organizations from ransomware events. Among these are team training to help identify and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's behavior-based cyberthreat defense to identify and quarantine day-zero modern malware assaults. Progent in addition can provide the services of experienced ransomware recovery consultants with the talent and commitment to rebuild a compromised system as urgently as possible.

Progent's Ransomware Recovery Support Services
After a crypto-ransomware event, even paying the ransom in cryptocurrency does not guarantee that cyber hackers will provide the codes to unencrypt any of your information. Kaspersky Labs estimated that 17% of crypto-ransomware victims never recovered their data even after having paid the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can reach millions. The fallback is to piece back together the mission-critical parts of your Information Technology environment. Absent access to full data backups, this requires a broad range of skill sets, professional project management, and the ability to work continuously until the recovery project is over.

For twenty years, Progent has made available expert Information Technology services for businesses throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have earned advanced certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have earned internationally-renowned certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience in financial management and ERP software solutions. This breadth of expertise provides Progent the ability to efficiently determine necessary systems and integrate the surviving pieces of your network environment after a ransomware attack and assemble them into an operational system.

Progent's ransomware team has top notch project management applications to orchestrate the complex restoration process. Progent understands the urgency of working quickly and in unison with a customer's management and Information Technology team members to prioritize tasks and to put the most important services back on-line as fast as possible.

Business Case Study: A Successful Ransomware Virus Response
A small business engaged Progent after their organization was brought down by Ryuk crypto-ransomware. Ryuk is believed to have been deployed by North Korean state sponsored hackers, possibly adopting techniques leaked from the United States National Security Agency. Ryuk attacks specific businesses with limited ability to sustain operational disruption and is among the most profitable versions of ransomware. Major victims include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturing business headquartered in the Chicago metro area and has about 500 staff members. The Ryuk event had shut down all essential operations and manufacturing processes. Most of the client's backups had been online at the time of the attack and were damaged. The client was pursuing financing for paying the ransom demand (in excess of two hundred thousand dollars) and hoping for the best, but ultimately reached out to Progent.

"I cannot thank you enough in regards to the expertise Progent gave us during the most critical period of (our) businesses survival. We most likely would have paid the cyber criminals behind the attack except for the confidence the Progent group gave us. That you could get our messaging and production servers back quicker than five days was amazing. Every single expert I spoke to or messaged at Progent was absolutely committed on getting us back on-line and was working at all hours to bail us out."

Progent worked with the client to quickly get our arms around and assign priority to the essential services that had to be recovered in order to restart departmental functions:

  • Active Directory
  • Microsoft Exchange
  • Accounting and Manufacturing Software
To start, Progent followed ransomware event mitigation industry best practices by halting the spread and disinfecting systems. Progent then initiated the task of restoring Microsoft AD, the key technology of enterprise networks built on Microsoft Windows technology. Microsoft Exchange email will not work without AD, and the client's accounting and MRP software used Microsoft SQL, which needs Active Directory services for authentication to the information.

Within two days, Progent was able to rebuild Active Directory services to its pre-intrusion state. Progent then charged ahead with setup and storage recovery of mission critical applications. All Microsoft Exchange Server ties and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was also able to assemble local OST files (Outlook Email Offline Data Files) on user workstations to recover email data. A recent offline backup of the customer's accounting/MRP systems made them able to restore these vital programs back available to users. Although major work remained to recover completely from the Ryuk damage, core services were returned to operations quickly:

"For the most part, the production operation did not miss a beat and we delivered all customer shipments."

Throughout the following few weeks key milestones in the recovery project were accomplished in tight collaboration between Progent consultants and the customer:

  • Self-hosted web applications were restored with no loss of information.
  • The MailStore Server exceeding 4 million historical messages was spun up and accessible to users.
  • CRM/Orders/Invoicing/AP/Accounts Receivables/Inventory modules were fully recovered.
  • A new Palo Alto Networks 850 firewall was deployed.
  • 90% of the desktops and laptops were fully operational.
"So much of what happened during the initial response is nearly entirely a haze for me, but my team will not soon forget the countless hours each and every one of the team accomplished to help get our business back. I've trusted Progent for at least 10 years, possibly more, and every time Progent has impressed me and delivered as promised. This situation was a life saver."

Conclusion
A probable business-killing disaster was averted with hard-working professionals, a broad spectrum of technical expertise, and close collaboration. Although in hindsight the ransomware virus attack described here would have been prevented with up-to-date cyber security systems and NIST Cybersecurity Framework best practices, user training, and properly executed security procedures for data backup and applying software patches, the reality is that government-sponsored hackers from Russia, North Korea and elsewhere are tireless and will continue. If you do get hit by a ransomware attack, remember that Progent's team of professionals has a proven track record in ransomware virus defense, remediation, and data restoration.

"So, to Darrin, Matt, Aaron, Dan, Jesse, Arnaud, Allen, Tony and Chris (and any others who were contributing), thank you for allowing me to get rested after we got past the first week. All of you did an impressive job, and if any of your team is in the Chicago area, a great meal is on me!"

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this ransomware incident report, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting in Vacaville
For ransomware system recovery consulting services in the Vacaville metro area, phone Progent at 800-462-8800 or visit Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.