Ransomware Response Services

Progent's Ransomware Negotiation Consulting in Anchorage
Progent is experienced in negotiating ransomware settlements with threat actors. Reaching an optimum settlement is a complicated exercise that requires a mix of real-word experience, technical skills and business acumen. It also requires working closely with the ransomware victim's IT team and the cyber insurance provider, if any. Because the number one priority of the ransomware target is fast recovery, it is critical to establish response groups that operate effectively, concurrently, and in close communication. Progent offers the breadth of technical knowledge and the deep bench of personnel to supplement your network staff and recover your network environment rapidly and economically.

Support available from Progent's ransomware settlement team include:

• Establishing the type of ransomware used in the assault
• Identifying and contacting the hacker
• Assessing the recovery risk
• Testing the threat actor's decryption capabilities
• Budgeting a settlement range with the victim and the cyber insurance provider
• Establishing a settlement and schedule with the threat actor
• Confirming accordance with anti-money laundering regulations
• Overseeing the crypto-currency transfer to the TA
• Acquiring, learning, and operating the threat actor's decryption utility
• If needed, contacting the hacker for assistance with the decryption tool

• Quarantining infected endpoints and data stores to arrest the progress of the attack
• Creating digital copies of every compromised server and endpoint and data store in order to perform forensics in parallel with recovery
• Installing anti-virus agents to all virus-free endpoints
• Restoring data from air-gapped backups or unscathed machines
• Creating a pristine environment
• Mapping and reconnecting datastores to match exactly their pre-encryption state

Exfiltration Ransoms
Beyond demanding payment for a decryption tool, modern strains of ransomware such as Ryuk, Maze, DopplePaymer, and Nephilim often try to steal (or "exfiltrate") information. TAs are then able to require an additional ransom in exchange for not divulging this data or selling it. Sadly, there is no method to guarantee that exfiltrated files have been totally deleted by the TA. In fact, in numerous cases the TA has little control about where the information ends up. Paying an exfiltration ransom does not free you from the need for seeking the advice of privacy attorneys, performing an investigation into which data were compromised, and performing the necessary alerts to impacted entities. In general, paying an exfiltration ransom is not recommended.

Progent's Qualifications
Progent has provided remote and onsite network services throughout the United States for over 20 years and has earned Microsoft's Partner designation in the Datacenter and Cloud Productivity competencies. Progent's roster of SMEs includes consultants who have earned advanced certifications in core technologies such as Cisco networking, VMware, and popular Linux distros. Progent's data security experts have earned industry-recognized certifications such as CISM, CISSP-ISSAP, GIAC, and CMMC 2.0. (Refer to certifications earned by Progent consultants). Progent also offers guidance in financial and ERP applications. This broad array of skills allows Progent to identify and consolidate the undamaged pieces of your IT environment after a ransomware intrusion and reconstruct them quickly into an operational network. Progent has collaborated with leading cyber insurance providers including Chubb to assist businesses recover from ransomware assaults.

Contact Progent about Ransomware Settlement Expertise in Anchorage
To contact with Progent about ransomware settlement services in Anchorage, phone Progent at 800-462-8800 or go to Contact Progent.