Ransomware Response Consulting Services

Progent's Ransomware Negotiation Services
Progent has experience negotiating ransomware settlements with adversaries. Negotiating an acceptable settlement is a complex activity that calls for a combination of field experience, technical knowledge and business savvy. It also requires close co-operation with the victim's IT staff and the cyber insurance carrier, if there is one. Because the top priority of the ransomware target is fast recovery, it is vital to establish response groups that operate effectively, concurrently, and in close communication. Progent offers the breadth of technical knowledge and the depth of personnel to supplement your IT support team and recover your network environment quickly and economically.

Services available from Progent's ransomware settlement negotiation team include:

• Establishing the type of ransomware involved in the attack
• Identifying and contacting the hacker
• Evaluating the recovery risk
• Verifying the hacker's decryption tool
• Deciding on an acceptable settlement range with the victim and the insurance provider
• Negotiating a settlement and timeline with the TA
• Verifying compliance with anti-money laundering (AML) laws
• Managing the crypto-currency disbursement to the TA
• Acquiring, learning, and operating the hacker's decryption mechanism
• If necessary, contacting the threat actor for assistance with the decryption utility

• Isolating infected endpoints and data stores to arrest the progress of the attack
• Making digital copies of every compromised device and data store to allow forensics without interfering with cleanup
• Installing anti-virus agents to all virus-free endpoints
• Restoring files from air-gapped backups or uncompromised machines
• Building a pristine recovery environment
• Mapping and connecting drives to match precisely their pre-attack state

Exfiltration Ransoms
Beyond extorting payment for a decryption tool, current variants of crypto-ransomware such as Ryuk, Maze, Netwalker, and Egregor often try to steal (or "exfiltrate") files. Hackers can then require an additional ransom for not divulging this information or selling it. Unfortunately, there exists no way to prove that stolen data have been completely deleted by the hacker. In fact, in many cases the hacker has limited say about where the information ends up. Paying an exfiltration ransom does not eliminate the need for seeking the guidance of privacy attorneys, conducting an audit on which data were compromised, and performing the required alerts to affected entities. In general, paying an exfiltration ransom is not recommended.

Progent's Background
Progent has provided remote and onsite network services across the United States for over two decades and has been awarded Microsoft's Gold Partner designation in the Datacenter and Cloud Productivity practice areas. Progent's team of SMEs includes professionals who have been awarded advanced certifications in core technology platforms including Cisco networking, VMware virtualization, and major Linux distros. Progent's data security consultants have earned industry-recognized certifications including CISM, CISSP-ISSAP, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also offers top-tier support in financial and ERP applications. This breadth of expertise gives Progent the ability to salvage and integrate the undamaged parts of your IT environment following a ransomware attack and rebuild them rapidly into a functioning network. Progent has collaborated with leading cyber insurance providers including Chubb to assist organizations clean up after ransomware attacks.

Contact Progent about Crypto-Ransomware Settlement Negotiation Guidance
To get in touch with Progent about crypto-ransomware settlement services, call Progent at 800-462-8800 or go to Contact Progent.