Ransomware Response Services

Overview of Progent's Ransomware Negotiation Consulting in Anchorage
Progent is experienced in negotiating ransomware settlements with hackers. Reaching an acceptable settlement is a complicated activity that calls for a combination of field experience, IT skills and business savvy. It also requires working closely with the cyber-extortion target's IT staff and the insurance carrier, if any. Because the number one goal of the ransomware victim is operational continuity, it is critical to establish response groups that work efficiently, concurrently, and in close communication. Progent has the breadth of IT knowledge and the deep bench of personnel to supplement your network staff and recover your network environment rapidly and affordably.

Support offered by Progent's ransomware settlement team include:

• Determining the type of ransomware involved in the assault
• making contact with the hacker
• Evaluating the likelihood of recovery
• Testing the TA's decryption tool
• Agreeing on a settlement range with the victim and the cyber insurance provider
• Negotiating a settlement amount and schedule with the threat actor
• Verifying accordance with anti-money laundering sanctions
• Managing the crypto-currency payment to the hacker
• Receiving, learning, and operating the TA's decryption utility
• If necessary, contacting the threat actor for technical help with the decryption utility

• Isolating infected endpoints and data stores to arrest the spread of the assault
• Creating replicas of each breached device and data store in order to perform forensics in parallel with recovery
• Adding anti-virus agents to all clean endpoints
• Recovering data from air-gapped backups or uncompromised machines
• Building a clean recovery environment
• Mapping and connecting drives to reflect precisely their pre-attack condition

Settling Exfiltration Ransoms
Beyond extorting payment for a decryption utility, current strains of ransomware such as Ryuk, Sodinokibi, Netwalker, and Nephilim often try to steal (or "exfiltrate") information. TAs are then able to demand an extra payment for not divulging this information or selling it. Sadly, there is no way to prove that exfiltrated files have been totally erased by the threat actor. In fact, in many instances the threat actor has little control about the disposition of the data. Paying an exfiltration ransom does not free you from the need for getting the advice of privacy lawyers, performing an investigation into which data were stolen, and sending the mandated alerts to impacted entities. In almost all cases, paying an exfiltration ransom is a waste.

Progent's Background
Progent has provided online and onsite IT services throughout the U.S. for more than two decades and has been awarded Microsoft's Gold Partner certification in the Datacenter and Cloud Productivity practice areas. Progent's team of subject matter experts includes consultants who have earned high-level certifications in core technologies such as Cisco infrastructure, VMware virtualization, and major distributions of Linux. Progent's data security experts have earned industry-recognized certifications including CISA, CISSP-ISSAP, and CRISC. (See Progent's certifications). Progent also offers top-tier support in financial and ERP application software. This breadth of skills gives Progent the ability to salvage and integrate the undamaged parts of your IT environment following a ransomware attack and rebuild them rapidly into an operational network. Progent has worked with leading cyber insurance providers including Chubb to assist organizations clean up after ransomware attacks.

Contact Progent about Ransomware Settlement Negotiation Expertise in Anchorage
To contact with Progent about crypto-ransomware settlement negotiation expertise in Anchorage, call Progent at 800-462-8800 or go to Contact Progent.