Ransomware Response Consultants

Overview of Progent's Ransomware Negotiation Services in Garland
Progent is experienced in negotiating ransomware settlements with hackers. Reaching an acceptable settlement is a complicated exercise that requires a combination of field experience, technical knowledge and business savvy. It also demands working closely with the ransomware victim's IT staff and the cyber insurance provider, if there is one. Since the top goal of the ransomware victim is fast recovery, it is critical to establish recovery teams that operate effectively, in parallel, and with intimate collaboration. Progent has the breadth of technical knowledge and the deep bench of experts to supplement your network support team and recover your network environment rapidly and economically.

Support available from Progent's ransomware settlement negotiation experts include:

• Establishing the kind of ransomware used in the assault
• making contact with the hacker
• Evaluating the recovery risk
• Testing the threat actor's decryption capabilities
• Budgeting a settlement amount with the ransomware victim and the insurance provider
• Negotiating a settlement and timeline with the threat actor
• Confirming accordance with anti-money laundering (AML) laws
• Carrying out the crypto-currency transfer to the hacker
• Receiving, learning, and using the hacker's decryptor tool
• If needed, contacting the threat actor for technical assistance with the decryptor utility

• Isolating affected endpoints to prevent further spread of the attack
• Creating digital copies of each infected server and endpoint and data store to allow forensics in parallel with recovery
• Installing A/V agents to all virus-free endpoints
• Recovering files from air-gapped restores or unscathed endpoints
• Creating a clean recovery environment
• Mapping and connecting datastores to reflect precisely their pre-encryption state

Paying Exfiltration Ransoms
In addition to extorting money for a decryption tool, current variants of ransomware such as Ryuk, Sodinokibi, Netwalker, and Nephilim commonly attempt to exfiltrate files. TAs are then able to demand a separate ransom in exchange for not posting this information or selling it. Unfortunately, there is no method to prove that exfiltrated data have been totally erased by the TA. In fact, in numerous instances the threat actor has limited control over the disposition of the data. Settling an exfiltration ransom does not eliminate the necessity of seeking the advice of legal counsel, performing an audit on which files were stolen, and carrying out the necessary notifications to affected entities. In almost all cases, paying an exfiltration ransom is not recommended.

Progent's Background
Progent has provided remote and on-premises IT services throughout the U.S. for over 20 years and has earned Microsoft's Gold Partner certification in the Datacenter and Cloud Productivity practice areas. Progent's roster of SMEs includes consultants who have been awarded high-level certifications in foundation technologies such as Cisco networking, VMware, and popular distributions of Linux. Progent's data security experts have earned industry-recognized certifications including CISM, CISSP-ISSAP, and CRISC. (See certifications earned by Progent consultants). Progent also offers guidance in financial management and ERP applications. This broad array of skills gives Progent the ability to salvage and consolidate the undamaged parts of your information system after a ransomware intrusion and reconstruct them rapidly into a functioning network. Progent has collaborated with top insurance carriers including Chubb to help organizations clean up after ransomware attacks.

Contact Progent about Crypto-Ransomware Settlement Guidance in Garland
To contact with Progent about crypto-ransomware settlement guidance in Garland, phone Progent at 800-462-8800 or go to Contact Progent.