Ransomware Response Consulting Services

Progent's Ransomware Settlement Negotiation Services in London
Progent has experience negotiating ransomware settlements with adversaries. Negotiating an optimum settlement is a complex exercise that calls for a mix of real-word experience, technical knowledge and business savvy. It also calls for working closely with the cyber-extortion target's IT team and the insurance provider, if any. Since the top goal of the ransomware victim is fast recovery, it is vital to deploy recovery groups that work efficiently, concurrently, and with intimate collaboration. Progent has the scope of technical knowledge and the depth of personnel to supplement your IT support team and restore your network environment rapidly and economically.

Support provided by Progent's ransomware settlement negotiation team include:

• Determining the kind of ransomware involved in the attack
• Identifying and communicating with the hacker persona
• Assessing the likelihood of recovery
• Validating the hacker's decryption tool
• Budgeting a settlement amount with the victim and the insurance carrier
• Establishing a settlement and timeline with the threat actor
• Confirming compliance with anti-money laundering (AML) regulations
• Managing the crypto-currency transfer to the hacker
• Receiving, learning, and using the threat actor's decryption utility
• If needed, contacting the hacker for technical help with the decryptor utility

• Isolating affected endpoints to prevent further spread of the attack
• Making digital copies of every infected server and endpoint and data store to allow forensics without interfering with cleanup
• Adding A/V protection to all virus-free endpoints
• Salvaging files from offline backups or unscathed machines
• Building a pristine recovery environment
• Mapping and reconnecting drives to match precisely their pre-attack condition

Exfiltration Ransoms
In addition to extorting money for a decryption tool, current strains of crypto-ransomware such as Ryuk, Maze, Netwalker, and Nephilim commonly try to exfiltrate files. TAs are then able to demand an additional settlement for not divulging this information or selling it. Sadly, there exists no method to prove that exfiltrated files have been completely deleted by the threat actor. Actually, in many instances the threat actor has little control over data custody. Paying an exfiltration ransom does not eliminate the necessity of seeking the guidance of legal counsel, conducting an audit on which files were compromised, and sending the required alerts to affected entities. In general, paying an exfiltration ransom is not recommended.

Progent's Qualifications
Progent has delivered remote and on-premises network services throughout the United States for more than two decades and has been awarded Microsoft's Partner certification in the Datacenter and Cloud Productivity competencies. Progent's roster of SMEs includes consultants who have earned advanced certifications in core technologies such as Cisco networking, VMware, and major distributions of Linux. Progent's cybersecurity experts have earned internationally recognized certifications including CISA, CISSP, GIAC, and CMMC 2.0. (Refer to certifications earned by Progent consultants). Progent also offers guidance in financial management and ERP software. This breadth of skills gives Progent the ability to identify and consolidate the undamaged pieces of your network following a ransomware attack and reconstruct them quickly into a viable network. Progent has worked with top insurance providers including Chubb to assist businesses recover from ransomware attacks.

Contact Progent about Ransomware Settlement Guidance in London
To get in touch with Progent about crypto-ransomware settlement expertise in London, call Progent at 800-462-8800 or go to Contact Progent.