Ransomware Response Services

Overview of Progent's Ransomware Settlement Negotiation Consulting in Mesa
Progent is experienced in negotiating ransomware settlements with threat actors (TAs). Reaching an optimum settlement is a complex exercise that calls for a mix of field experience, technical knowledge and business savvy. It also calls for working closely with the cyber-extortion target's IT team and the cyber insurance carrier, if there is one. Since the top priority of the ransomware target is fast recovery, it is vital to establish recovery teams that operate effectively, concurrently, and in close communication. Progent offers the breadth of technical knowledge and the deep bench of personnel to complement your network support team and recover your network quickly and affordably.

Services available from Progent's ransomware negotiation team include:

• Establishing the kind of ransomware used in the assault
• Identifying and communicating with the hacker
• Evaluating the likelihood of recovery
• Verifying the threat actor's decryption capabilities
• Deciding on an acceptable settlement amount with the victim and the insurance carrier
• Negotiating a settlement and schedule with the hacker
• Checking compliance with anti-money laundering (AML) laws
• Carrying out the crypto-currency transfer to the hacker
• Acquiring, learning, and using the TA's decryption tool
• If needed, contacting the hacker for technical help with the decryption utility

• Quarantining affected endpoints and data stores to arrest the spread of the attack
• Creating digital copies of each infected server and endpoint and data store in order to perform forensics in parallel with recovery
• Installing anti-virus agents to all virus-free endpoints
• Salvaging files from offline restores or unscathed machines
• Building a pristine recovery environment
• Remapping and connecting drives to reflect precisely their pre-attack state

Exfiltration Ransoms
Beyond demanding money for a decryption utility, modern variants of ransomware like Ryuk, Maze, Netwalker, and Nephilim commonly attempt to steal (or "exfiltrate") files. Hackers are then able to require an extra payment for not posting this data on the dark web. Sadly, there exists no method to prove that exfiltrated files have been totally erased by the hacker. In fact, in numerous instances the TA has limited control about where the information ends up. Paying an exfiltration ransom does not eliminate the necessity of engaging the advice of privacy attorneys, performing an inventory of data were taken, and sending the mandated notifications to impacted entities. In general, paying an exfiltration ransom is a waste.

Progent's Qualifications
Progent has provided remote and on-premises network services throughout the United States for over 20 years and has earned Microsoft's Gold Partner certification in the Datacenter and Cloud Productivity competencies. Progent's team of SBEs includes consultants who have earned advanced certifications in core technology platforms including Cisco networking, VMware virtualization, and popular Linux distros. Progent's cybersecurity consultants have earned internationally recognized certifications including CISA, CISSP, and GIAC. (See Progent's certifications). Progent also offers top-tier support in financial and ERP applications. This breadth of expertise gives Progent the ability to identify and integrate the undamaged pieces of your IT environment following a ransomware attack and reconstruct them rapidly into an operational system. Progent has worked with top insurance carriers including Chubb to help businesses recover from ransomware assaults.

Contact Progent about Ransomware Settlement Guidance in Mesa
To contact with Progent about crypto-ransomware settlement negotiation services in Mesa, phone Progent at 800-462-8800 or go to Contact Progent.