Ransomware Response Services

Progent's Ransomware Negotiation Consulting
Progent is experienced in negotiating ransomware settlements with threat actors. Negotiating an optimum settlement is a complicated exercise that calls for a mix of field experience, IT knowledge and business acumen. It also demands working closely with the ransomware victim's IT staff and the insurance provider, if there is one. Since the top goal of the ransomware target is operational continuity, it is critical to establish recovery teams that operate effectively, in parallel, and in close communication. Progent has the breadth of technical knowledge and the depth of experts to complement your network staff and recover your network quickly and economically.

Support available from Progent's ransomware settlement experts include:

• Determining the kind of ransomware involved in the assault
• Identifying and communicating with the hacker persona
• Evaluating the recovery risk
• Verifying the TA's decryption tool
• Agreeing on a settlement with the victim and the insurance carrier
• Negotiating a settlement and schedule with the TA
• Checking compliance with anti-money laundering regulations
• Overseeing the crypto-currency disbursement to the TA
• Acquiring, learning, and operating the threat actor's decryption utility
• If needed, contacting the threat actor for technical help with the decryption utility

• Isolating infected endpoints and data stores to prevent further progress of the attack
• Creating digital copies of every compromised server and endpoint and data store in order to perform forensics without interfering with recovery
• Installing anti-virus protection to all clean endpoints
• Salvaging data from offline backups or uncompromised machines
• Building a pristine recovery environment
• Mapping and connecting datastores to reflect exactly their pre-encryption state

Settling Exfiltration Ransoms
In addition to demanding money for a decryption tool, current variants of ransomware like Ryuk, Sodinokibi, DopplePaymer, and Egregor commonly try to exfiltrate information. Hackers can then demand an additional settlement for not divulging this data or selling it. Sadly, there exists no way to prove that stolen files have been totally deleted by the hacker. In fact, in numerous cases the TA has limited control over data custody. Paying an exfiltration ransom does not free you from the need for getting the advice of legal counsel, performing an investigation into which data were compromised, and carrying out the mandated notifications to impacted entities. Generally, paying an exfiltration ransom is a waste.

Progent's Background
Progent has provided online and onsite IT services across the U.S. for more than 20 years and has earned Microsoft's Partner certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have been awarded advanced certifications in foundation technology platforms such as Cisco networking, VMware virtualization, and popular Linux distros. Progent's cybersecurity consultants have earned industry-recognized certifications including CISM, CISSP, CRISC, and CMMC 2.0. (See Progent's certifications). Progent also offers guidance in financial and ERP software. This broad array of skills allows Progent to identify and integrate the surviving pieces of your network following a ransomware intrusion and rebuild them rapidly into an operational network. Progent has worked with leading cyber insurance providers like Chubb to assist organizations recover from ransomware attacks.

Contact Progent about Crypto-Ransomware Settlement Negotiation Services
To contact with Progent about ransomware settlement negotiation guidance, phone Progent at 800-462-8800 or go to Contact Progent.