Ransomware Response Consulting Services

Overview of Progent's Ransomware Negotiation Services
Progent is experienced in negotiating ransomware settlements with attackers. Negotiating an optimum settlement is a complex exercise that requires a mix of field experience, IT skills and business savvy. It also demands working closely with the victim's IT team and the insurance carrier, if there is one. Because the top goal of the ransomware victim is operational continuity, it is critical to establish recovery groups that work effectively, in parallel, and with intimate collaboration. Progent has the scope of IT knowledge and the deep bench of experts to supplement your IT support team and recover your network environment rapidly and economically.

Support provided by Progent's ransomware settlement negotiation experts include:

• Determining the type of ransomware involved in the attack
• Making contact with the hacker persona
• Assessing the recovery risk
• Verifying the TA's decryption capabilities
• Agreeing on a settlement with the ransomware victim and the insurance carrier
• Establishing a settlement and timeline with the hacker
• Verifying accordance with anti-money laundering (AML) sanctions
• Carrying out the crypto-currency disbursement to the hacker
• Acquiring, reviewing, and operating the threat actor's decryption utility
• If needed, contacting the threat actor for technical help with the decryptor tool

• Isolating infected endpoints to prevent further progress of the attack
• Making replicas of each compromised server and endpoint and data store in order to perform forensics in parallel with cleanup
• Installing anti-virus protection to all clean endpoints
• Recovering files from air-gapped restores or unscathed endpoints
• Building a clean environment
• Mapping and reconnecting drives to reflect precisely their pre-encryption state

Paying Exfiltration Ransoms
Beyond demanding payment for a decryption tool, modern strains of crypto-ransomware like Ryuk, Maze, Netwalker, and Nephilim commonly try to steal (or "exfiltrate") information. Hackers are then able to require an additional payment in exchange for not posting this information on the dark web. Sadly, there exists no way to guarantee that exfiltrated data have been totally deleted by the threat actor. In fact, in numerous cases the threat actor has limited say over the disposition of the data. Paying an exfiltration ransom does not free you from the need for getting the advice of legal counsel, performing an audit on which data were compromised, and sending the mandated alerts to impacted entities. In almost all cases, paying an exfiltration ransom is not recommended.

Progent's Background
Progent has delivered remote and onsite IT services across the U.S. for over two decades and has earned Microsoft's Partner certification in the Datacenter and Cloud Productivity practice areas. Progent's team of subject matter experts (SMEs) includes professionals who have been awarded high-level certifications in foundation technology platforms including Cisco infrastructure, VMware virtualization, and popular Linux distros. Progent's data security consultants have earned internationally recognized certifications including CISM, CISSP, CRISC, and CMMC 2.0. (Refer to certifications earned by Progent consultants). Progent also has guidance in financial management and Enterprise Resource Planning application software. This scope of expertise allows Progent to salvage and integrate the undamaged pieces of your network following a ransomware attack and rebuild them rapidly into an operational network. Progent has worked with leading cyber insurance providers like Chubb to help businesses recover from ransomware attacks.

Contact Progent about Ransomware Settlement Negotiation Services
To contact with Progent about crypto-ransomware settlement services, call Progent at 800-462-8800 or go to Contact Progent.