Crypto-Ransomware : Your Crippling Information Technology Disaster
Ransomware Recovery ConsultantsRansomware has become an escalating cyber pandemic that presents an extinction-level danger for organizations unprepared for an assault. Versions of ransomware like the CrySIS, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been circulating for years and still inflict havoc. More recent strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, plus frequent as yet unnamed viruses, not only encrypt online files but also infect any available system restores and backups. Data synchronized to cloud environments can also be ransomed. In a vulnerable environment, it can make any restoration useless and basically sets the entire system back to zero.

Getting back online programs and data after a ransomware outage becomes a race against the clock as the targeted business tries its best to stop the spread, cleanup the virus, and resume mission-critical activity. Due to the fact that crypto-ransomware takes time to spread throughout a network, assaults are usually sprung during nights and weekends, when penetrations may take longer to discover. This compounds the difficulty of quickly mobilizing and coordinating an experienced response team.

Progent offers an assortment of help services for protecting Winston-Salem businesses from ransomware attacks. Among these are team member training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's behavior-based threat defense to detect and suppress zero-day modern malware attacks. Progent also can provide the services of seasoned crypto-ransomware recovery engineers with the talent and commitment to restore a compromised environment as soon as possible.

Progent's Ransomware Recovery Help
Subsequent to a ransomware invasion, sending the ransom in cryptocurrency does not provide any assurance that cyber criminals will provide the needed keys to decipher any of your data. Kaspersky Labs estimated that 17% of ransomware victims never recovered their information even after having paid the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The other path is to re-install the key elements of your IT environment. Absent access to full system backups, this calls for a broad range of skills, top notch project management, and the ability to work 24x7 until the job is complete.

For decades, Progent has made available expert Information Technology services for companies across the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have been awarded high-level certifications in key technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have earned internationally-recognized industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with accounting and ERP application software. This breadth of experience gives Progent the capability to rapidly identify critical systems and re-organize the surviving pieces of your Information Technology system after a ransomware event and rebuild them into an operational network.

Progent's ransomware team uses top notch project management systems to orchestrate the complicated recovery process. Progent appreciates the urgency of working rapidly and in unison with a client's management and IT team members to prioritize tasks and to get key applications back on-line as fast as possible.

Client Story: A Successful Ransomware Penetration Restoration
A small business sought out Progent after their network was crashed by Ryuk ransomware. Ryuk is believed to have been developed by North Korean state cybercriminals, suspected of adopting technology exposed from the U.S. National Security Agency. Ryuk goes after specific companies with limited ability to sustain operational disruption and is one of the most lucrative instances of crypto-ransomware. Well Known organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturing company headquartered in Chicago and has around 500 workers. The Ryuk attack had shut down all business operations and manufacturing capabilities. Most of the client's system backups had been online at the beginning of the attack and were encrypted. The client was actively seeking loans for paying the ransom demand (in excess of $200K) and wishfully thinking for good luck, but in the end made the decision to use Progent.

"I can't tell you enough about the help Progent gave us throughout the most fearful time of (our) businesses survival. We most likely would have paid the Hackers except for the confidence the Progent experts afforded us. The fact that you could get our messaging and essential applications back into operation quicker than seven days was beyond my wildest dreams. Each staff member I worked with or texted at Progent was absolutely committed on getting us restored and was working 24 by 7 on our behalf."

Progent worked hand in hand the client to quickly determine and assign priority to the critical systems that needed to be restored in order to resume business operations:

  • Active Directory
  • Microsoft Exchange Server
  • MRP System
To get going, Progent adhered to Anti-virus incident response best practices by halting lateral movement and clearing up compromised systems. Progent then began the process of recovering Microsoft Active Directory, the heart of enterprise systems built upon Microsoft technology. Microsoft Exchange messaging will not operate without AD, and the businesses' financials and MRP system leveraged Microsoft SQL, which depends on Active Directory services for security authorization to the database.

In less than 48 hours, Progent was able to rebuild Active Directory to its pre-intrusion state. Progent then accomplished reinstallations and hard drive recovery on essential systems. All Microsoft Exchange Server ties and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was able to find non-encrypted OST files (Outlook Off-Line Data Files) on various desktop computers in order to recover mail information. A not too old offline backup of the businesses accounting/MRP systems made them able to recover these essential services back available to users. Although a lot of work needed to be completed to recover totally from the Ryuk damage, core services were returned to operations rapidly:

"For the most part, the production operation never missed a beat and we delivered all customer orders."

Over the following couple of weeks critical milestones in the recovery process were achieved through close collaboration between Progent engineers and the client:

  • Internal web applications were returned to operation without losing any information.
  • The MailStore Exchange Server with over four million historical emails was restored to operations and available for users.
  • CRM/Customer Orders/Invoices/Accounts Payable (AP)/AR/Inventory Control modules were 100 percent functional.
  • A new Palo Alto Networks 850 security appliance was installed and configured.
  • Most of the desktop computers were back into operation.
"A huge amount of what went on those first few days is mostly a blur for me, but I will not soon forget the commitment each and every one of the team put in to give us our business back. I've entrusted Progent for the past ten years, maybe more, and every time I needed help Progent has outperformed my expectations and delivered as promised. This time was a testament to your capabilities."

Conclusion
A potential business extinction disaster was evaded with top-tier professionals, a wide spectrum of subject matter expertise, and close teamwork. Although in post mortem the ransomware attack detailed here would have been disabled with modern security technology solutions and ISO/IEC 27001 best practices, staff training, and well thought out incident response procedures for backup and keeping systems up to date with security patches, the fact is that government-sponsored cybercriminals from Russia, China and elsewhere are tireless and will continue. If you do get hit by a ransomware attack, remember that Progent's team of experts has a proven track record in crypto-ransomware virus blocking, mitigation, and information systems recovery.

"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Tony and Chris (along with others who were contributing), thank you for allowing me to get some sleep after we made it past the initial fire. Everyone did an impressive job, and if any of your team is in the Chicago area, dinner is on me!"

Download the Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this ransomware incident report, please click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting in Winston-Salem
For ransomware system recovery expertise in the Winston-Salem metro area, call Progent at 800-462-8800 or go to Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.