Ransomware Response Consulting Experts

Progent's Ransomware Negotiation Consulting in Baltimore
Progent has experience negotiating ransomware settlements with threat actors. Negotiating an acceptable settlement is a complicated exercise that calls for a combination of real-word experience, technical knowledge and business acumen. It also calls for close co-operation with the cyber-extortion target's IT team and the insurance carrier, if any. Since the top goal of the ransomware victim is operational continuity, it is critical to establish response groups that work effectively, in parallel, and in close communication. Progent offers the breadth of IT knowledge and the deep bench of experts to supplement your IT staff and restore your network quickly and affordably.

Support available from Progent's ransomware settlement negotiation experts include:

• Determining the kind of ransomware involved in the attack
• making contact with the hacker persona
• Evaluating the likelihood of recovery
• Testing the TA's decryption capabilities
• Determining a settlement with the ransomware victim and the cyber insurance carrier
• Negotiating a settlement and schedule with the hacker
• Confirming accordance with anti-money laundering sanctions
• Overseeing the crypto-currency transfer to the hacker
• Acquiring, reviewing, and operating the threat actor's decryptor utility
• If necessary, contacting the hacker for technical help with the decryptor tool

• Quarantining infected endpoints to prevent further progress of the attack
• Making digital copies of every breached device and data store to allow forensics without interfering with cleanup
• Installing anti-virus protection to all virus-free endpoints
• Salvaging files from air-gapped backups or uncompromised machines
• Creating a clean recovery environment
• Remapping and reconnecting drives to match exactly their pre-encryption condition

Exfiltration Ransoms
Beyond demanding money for a decryption tool, modern variants of ransomware like Ryuk, Maze, Netwalker, and Egregor often try to exfiltrate files. TAs are then able to demand an extra ransom in exchange for not publishing this information on the dark web. Unfortunately, there is no method to be certain that exfiltrated files have been completely deleted by the threat actor. In fact, in numerous instances the TA has limited control over the disposition of the data. Paying an exfiltration ransom does not eliminate the need for getting the advice of privacy lawyers, conducting an inventory of files were stolen, and sending the necessary notifications to affected entities. Generally, paying an exfiltration ransom is not recommended.

Progent's Background
Progent has delivered remote and onsite IT services across the United States for over 20 years and has earned Microsoft's Gold Partner designation in the Datacenter and Cloud Productivity competencies. Progent's team of SMEs includes consultants who have earned advanced certifications in foundation technology platforms such as Cisco networking, VMware, and popular distributions of Linux. Progent's data security experts have earned prestigious certifications including CISA, CISSP, and CRISC. (See certifications earned by Progent consultants). Progent also offers top-tier support in financial and ERP applications. This broad array of skills gives Progent the ability to identify and consolidate the surviving parts of your IT environment after a ransomware assault and rebuild them rapidly into an operational system. Progent has worked with leading insurance carriers including Chubb to help businesses clean up after ransomware assaults.

Contact Progent about Crypto-Ransomware Settlement Negotiation Guidance in Baltimore
To contact with Progent about ransomware settlement expertise in Baltimore, phone Progent at 800-462-8800 or go to Contact Progent.