Ransomware Response Services

Overview of Progent's Ransomware Settlement Negotiation Consulting in Alpharetta
Progent has experience negotiating ransomware settlements with attackers. Negotiating an optimum settlement is a complex exercise that requires a mix of field experience, IT knowledge and business acumen. It also demands close co-operation with the ransomware victim's IT staff and the cyber insurance provider, if there is one. Since the top priority of the ransomware target is fast recovery, it is vital to deploy recovery groups that work effectively, concurrently, and with intimate collaboration. Progent offers the breadth of IT knowledge and the deep bench of experts to supplement your IT support team and restore your network environment rapidly and economically.

Support available from Progent's ransomware settlement team include:

• Establishing the type of ransomware involved in the assault
• Identifying and contacting the hacker
• Assessing the likelihood of recovery
• Testing the TA's decryption capabilities
• Agreeing on a settlement payment with the victim and the insurance provider
• Negotiating a settlement amount and schedule with the hacker
• Confirming adherence to anti-money laundering laws
• Managing the crypto-currency disbursement to the TA
• Acquiring, learning, and using the threat actor's decryption tool
• If necessary, contacting the threat actor for assistance with the decryptor tool

• Quarantining infected endpoints to arrest the spread of the attack
• Making replicas of every breached server and endpoint and data store to allow forensics in parallel with restoration
• Installing A/V agents to all virus-free endpoints
• Recovering files from air-gapped backups or uncompromised machines
• Building a clean recovery environment
• Mapping and connecting datastores to reflect exactly their pre-encryption state

Paying Exfiltration Ransoms
Beyond extorting money for a decryption tool, current strains of crypto-ransomware such as Ryuk, Sodinokibi, DopplePaymer, and Egregor often attempt to exfiltrate information. Hackers are then able to require a separate payment in exchange for not divulging this data or selling it. Sadly, there exists no method to be certain that stolen files have been completely erased by the threat actor. In fact, in many cases the hacker has little control over where the information ends up. Settling an exfiltration ransom does not free you from the need for engaging the advice of privacy lawyers, performing an inventory of data were taken, and performing the necessary notifications to impacted entities. Generally, paying an exfiltration ransom is not recommended.

Progent's Background
Progent has delivered remote and on-premises network services across the United States for more than two decades and has earned Microsoft's Partner designation in the Datacenter and Cloud Productivity practice areas. Progent's team of subject matter experts includes professionals who have earned advanced certifications in core technology platforms such as Cisco infrastructure, VMware, and major distributions of Linux. Progent's data security experts have earned internationally recognized certifications including CISM, CISSP, CRISC, and CMMC 2.0. (See certifications earned by Progent consultants). Progent also offers top-tier support in financial and Enterprise Resource Planning application software. This broad array of skills gives Progent the ability to salvage and integrate the surviving pieces of your information system following a ransomware attack and rebuild them rapidly into a functioning system. Progent has worked with top insurance carriers like Chubb to help organizations clean up after ransomware attacks.

Contact Progent about Crypto-Ransomware Settlement Guidance in Alpharetta
To get in touch with Progent about ransomware settlement guidance in Alpharetta, phone Progent at 800-462-8800 or go to Contact Progent.