Ransomware Response Services

Overview of Progent's Ransomware Negotiation Consulting in Phoenix
Progent is experienced in negotiating ransomware settlements with threat actors. Negotiating an optimum settlement is a complex activity that calls for a combination of real-word experience, IT skills and business acumen. It also calls for working closely with the ransomware victim's IT team and the insurance carrier, if any. Since the number one priority of the ransomware target is fast recovery, it is critical to deploy response groups that operate effectively, concurrently, and in close communication. Progent has the scope of IT knowledge and the deep bench of experts to complement your IT support team and restore your network quickly and affordably.

Services provided by Progent's ransomware settlement negotiation team include:

• Establishing the type of ransomware used in the assault
• Identifying and communicating with the hacker
• Evaluating the likelihood of recovery
• Validating the hacker's decryption tool
• Budgeting a settlement with the ransomware victim and the cyber insurance carrier
• Negotiating a settlement and timeline with the TA
• Checking adherence to anti-money laundering (AML) sanctions
• Carrying out the crypto-currency transfer to the TA
• Receiving, reviewing, and using the hacker's decryptor mechanism
• If needed, contacting the TA for technical help with the decryption utility

• Quarantining affected endpoints and data stores to prevent further spread of the assault
• Creating replicas of each breached server and endpoint and data store in order to perform forensics without interfering with cleanup
• Adding anti-virus protection to all virus-free endpoints
• Salvaging data from offline restores or unscathed endpoints
• Creating a pristine recovery environment
• Mapping and connecting datastores to reflect precisely their pre-encryption condition

Exfiltration Ransoms
Beyond extorting money for a decryption utility, current strains of ransomware such as Ryuk, Sodinokibi, DopplePaymer, and Egregor commonly try to exfiltrate information. Hackers can then demand an extra settlement for not divulging this data on the dark web. Sadly, there is no way to prove that exfiltrated data have been completely erased by the hacker. In fact, in many instances the hacker has little control over who can access the stolen files. Paying an exfiltration ransom does not eliminate the necessity of seeking the advice of legal counsel, performing an investigation into which files were stolen, and carrying out the required alerts to impacted entities. Generally, paying an exfiltration ransom is a waste.

Progent's Background
Progent has provided online and onsite IT services throughout the U.S. for more than 20 years and has been awarded Microsoft's Partner designation in the Datacenter and Cloud Productivity practice areas. Progent's team of SMEs includes consultants who have earned advanced certifications in foundation technology platforms including Cisco infrastructure, VMware virtualization, and major distributions of Linux. Progent's data security experts have earned industry-recognized certifications such as CISM, CISSP, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has guidance in financial and Enterprise Resource Planning applications. This broad array of expertise gives Progent the ability to identify and consolidate the surviving parts of your IT environment after a ransomware attack and reconstruct them rapidly into an operational network. Progent has worked with leading insurance providers like Chubb to help businesses clean up after ransomware attacks.

Contact Progent about Ransomware Settlement Expertise in Phoenix
To contact with Progent about crypto-ransomware settlement guidance in Phoenix, phone Progent at 800-462-8800 or go to Contact Progent.