Ransomware Response Services

Overview of Progent's Ransomware Settlement Negotiation Services in Indianapolis
Progent is experienced in negotiating ransomware settlements with threat actors. Negotiating an acceptable settlement is a complicated exercise that requires a mix of real-word experience, technical knowledge and business acumen. It also calls for close co-operation with the ransomware victim's IT staff and the cyber insurance provider, if any. Because the top goal of the ransomware target is fast recovery, it is vital to deploy recovery groups that work efficiently, concurrently, and with intimate collaboration. Progent has the breadth of IT skills and the depth of experts to complement your network support team and restore your network rapidly and affordably.

Services provided by Progent's ransomware settlement experts include:

• Establishing the type of ransomware involved in the assault
• Identifying and communicating with the hacker persona
• Evaluating the likelihood of recovery
• Testing the TA's decryption capabilities
• Determining a settlement payment with the ransomware victim and the cyber insurance provider
• Negotiating a settlement and timeline with the threat actor
• Verifying compliance with anti-money laundering (AML) sanctions
• Overseeing the crypto-currency payment to the hacker
• Receiving, reviewing, and using the threat actor's decryption tool
• If necessary, contacting the hacker for technical assistance with the decryptor utility

• Quarantining affected endpoints and data stores to arrest the progress of the attack
• Making digital copies of each compromised server and endpoint and data store in order to perform forensics in parallel with cleanup
• Adding A/V agents to all virus-free endpoints
• Restoring files from air-gapped restores or uncompromised endpoints
• Creating a clean recovery environment
• Mapping and connecting datastores to reflect exactly their pre-attack state

Settling Exfiltration Ransoms
Beyond demanding money for a decryption utility, modern variants of ransomware like Ryuk, Sodinokibi, Netwalker, and Egregor commonly attempt to exfiltrate files. TAs are then able to require an extra payment for not posting this information on the dark web. Sadly, there is no way to prove that stolen files have been completely deleted by the threat actor. Actually, in numerous cases the threat actor has limited say over where the information ends up. Paying an exfiltration ransom does not eliminate the necessity of getting the advice of privacy attorneys, performing an investigation into which files were stolen, and performing the required alerts to impacted entities. In almost all cases, paying an exfiltration ransom is not recommended.

Progent's Qualifications
Progent has delivered online and onsite IT services across the United States for more than 20 years and has been awarded Microsoft's Partner designation in the Datacenter and Cloud Productivity practice areas. Progent's team of subject matter experts includes professionals who have been awarded advanced certifications in core technology platforms including Cisco networking, VMware, and major Linux distros. Progent's cybersecurity consultants have earned industry-recognized certifications such as CISM, CISSP, CRISC, and CMMC 2.0. (Refer to certifications earned by Progent consultants). Progent also offers top-tier support in financial and Enterprise Resource Planning application software. This breadth of skills allows Progent to identify and integrate the surviving pieces of your IT environment after a ransomware assault and rebuild them quickly into an operational system. Progent has worked with leading cyber insurance providers including Chubb to help organizations recover from ransomware assaults.

Contact Progent about Crypto-Ransomware Settlement Guidance in Indianapolis
To get in touch with Progent about crypto-ransomware settlement expertise in Indianapolis, phone Progent at 800-462-8800 or go to Contact Progent.