Ransomware Response Consultants

Overview of Progent's Ransomware Negotiation Consulting in Cincinnati
Progent is experienced in negotiating ransomware settlements with threat actors (TAs). Negotiating an optimum settlement is a complicated exercise that calls for a combination of field experience, IT knowledge and business acumen. It also calls for close co-operation with the cyber-extortion target's IT staff and the insurance provider, if any. Since the number one priority of the ransomware target is operational continuity, it is critical to deploy recovery teams that operate efficiently, concurrently, and with intimate collaboration. Progent has the breadth of technical skills and the depth of personnel to complement your network support team and restore your network environment rapidly and economically.

Support available from Progent's ransomware settlement experts include:

• Establishing the type of ransomware involved in the attack
• making contact with the hacker persona
• Assessing the recovery risk
• Testing the hacker's decryption capabilities
• Deciding on an acceptable settlement payment with the ransomware victim and the insurance provider
• Negotiating a settlement and timeline with the threat actor
• Checking accordance with anti-money laundering regulations
• Managing the crypto-currency transfer to the hacker
• Acquiring, reviewing, and using the threat actor's decryption utility
• If necessary, contacting the hacker for assistance with the decryptor utility

• Quarantining infected endpoints and data stores to arrest the progress of the attack
• Creating digital copies of every infected server and endpoint and data store in order to perform forensics in parallel with cleanup
• Adding anti-virus agents to all clean endpoints
• Recovering files from air-gapped backups or uncompromised machines
• Building a pristine recovery environment
• Remapping and connecting datastores to match precisely their pre-encryption state

Paying Exfiltration Ransoms
In addition to demanding payment for a decryption tool, modern variants of crypto-ransomware like Ryuk, Maze, Netwalker, and Egregor often try to exfiltrate files. TAs are then able to require an extra ransom for not divulging this information on the dark web. Sadly, there is no method to prove that stolen data have been completely erased by the threat actor. In fact, in many cases the threat actor has little control about who can access the stolen files. Paying an exfiltration ransom does not free you from the need for getting the advice of privacy attorneys, performing an investigation into which data were stolen, and carrying out the mandated notifications to impacted entities. In general, paying an exfiltration ransom is a waste.

Progent's Background
Progent has delivered online and on-premises IT services across the U.S. for over 20 years and has earned Microsoft's Gold Partner designation in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have earned high-level certifications in core technology platforms such as Cisco networking, VMware virtualization, and popular Linux distros. Progent's cybersecurity consultants have earned industry-recognized certifications including CISA, CISSP, and GIAC. (See certifications earned by Progent consultants). Progent also offers guidance in financial and ERP software. This broad array of skills gives Progent the ability to salvage and consolidate the surviving pieces of your network after a ransomware intrusion and reconstruct them rapidly into a functioning network. Progent has worked with leading cyber insurance providers like Chubb to help businesses clean up after ransomware attacks.

Contact Progent about Ransomware Settlement Services in Cincinnati
To contact with Progent about crypto-ransomware settlement negotiation guidance in Cincinnati, phone Progent at 800-462-8800 or go to Contact Progent.