Ransomware Response Consulting Experts

Progent's Ransomware Settlement Negotiation Consulting in Sorocaba
Progent has experience negotiating ransomware settlements with adversaries. Negotiating an optimum settlement is a complicated activity that requires a combination of real-word experience, technical skills and business savvy. It also calls for working closely with the ransomware victim's IT staff and the insurance carrier, if there is one. Because the number one goal of the ransomware target is fast recovery, it is critical to establish response groups that work efficiently, in parallel, and in close communication. Progent has the breadth of technical knowledge and the deep bench of personnel to complement your network support team and recover your network rapidly and economically.

Support provided by Progent's ransomware negotiation team include:

• Determining the type of ransomware used in the attack
• Identifying and communicating with the hacker
• Evaluating the recovery risk
• Validating the hacker's decryption tool
• Deciding on an acceptable settlement with the ransomware victim and the cyber insurance carrier
• Establishing a settlement amount and schedule with the hacker
• Verifying accordance with anti-money laundering (AML) regulations
• Carrying out the crypto-currency disbursement to the hacker
• Acquiring, learning, and using the threat actor's decryptor mechanism
• If necessary, contacting the threat actor for technical help with the decryptor utility

• Quarantining affected endpoints to prevent further progress of the assault
• Creating replicas of every breached device and data store in order to perform forensics without interfering with recovery
• Adding A/V agents to all clean endpoints
• Recovering files from offline restores or unscathed endpoints
• Creating a pristine recovery environment
• Mapping and connecting drives to reflect exactly their pre-encryption state

Settling Exfiltration Ransoms
Beyond extorting payment for a decryption tool, modern variants of crypto-ransomware such as Ryuk, Maze, Netwalker, and Egregor often try to steal (or "exfiltrate") information. TAs can then demand an additional ransom for not publishing this information or selling it. Sadly, there is no method to be certain that stolen data have been completely erased by the TA. In fact, in many cases the threat actor has little control about where the information ends up. Paying an exfiltration ransom does not eliminate the necessity of engaging the guidance of legal counsel, conducting an audit on which files were taken, and performing the necessary notifications to affected entities. In almost all cases, paying an exfiltration ransom is not recommended.

Progent's Background
Progent has provided remote and on-premises network services throughout the U.S. for more than 20 years and has been awarded Microsoft's Gold Partner certification in the Datacenter and Cloud Productivity competencies. Progent's team of SMEs includes consultants who have earned high-level certifications in foundation technologies such as Cisco networking, VMware, and major distributions of Linux. Progent's cybersecurity experts have earned prestigious certifications such as CISM, CISSP-ISSAP, GIAC, and CMMC 2.0. (Refer to certifications earned by Progent consultants). Progent also offers guidance in financial and ERP application software. This scope of skills allows Progent to identify and consolidate the surviving pieces of your information system following a ransomware intrusion and rebuild them rapidly into a functioning network. Progent has collaborated with leading cyber insurance providers like Chubb to assist businesses clean up after ransomware attacks.

Contact Progent about Ransomware Settlement Services in Sorocaba
To contact with Progent about crypto-ransomware settlement negotiation services in Sorocaba, call Progent at 800-462-8800 or go to Contact Progent.