Ransomware Response Consultants

Overview of Progent's Ransomware Negotiation Consulting in Providence
Progent is experienced in negotiating ransomware settlements with attackers. Negotiating an acceptable settlement is a complex exercise that requires a mix of field experience, IT skills and business acumen. It also calls for close co-operation with the ransomware victim's IT staff and the insurance provider, if any. Because the top priority of the ransomware victim is fast recovery, it is critical to deploy recovery groups that work effectively, concurrently, and in close communication. Progent has the scope of IT skills and the deep bench of personnel to complement your IT staff and restore your network quickly and affordably.

Support offered by Progent's ransomware settlement team include:

• Determining the type of ransomware used in the attack
• Making contact with the hacker persona
• Evaluating the recovery risk
• Validating the TA's decryption tool
• Determining a settlement payment with the victim and the insurance provider
• Establishing a settlement and timeline with the hacker
• Confirming adherence to anti-money laundering (AML) sanctions
• Overseeing the crypto-currency transfer to the TA
• Acquiring, learning, and operating the hacker's decryptor mechanism
• If necessary, contacting the threat actor for assistance with the decryptor tool

• Isolating affected endpoints and data stores to prevent further progress of the attack
• Making replicas of each compromised device and data store to allow forensics in parallel with restoration
• Adding anti-virus agents to all clean endpoints
• Salvaging files from offline backups or uncompromised endpoints
• Building a pristine environment
• Mapping and reconnecting datastores to match exactly their pre-encryption condition

Settling Exfiltration Ransoms
In addition to demanding money for a decryption tool, modern strains of ransomware like Ryuk, Sodinokibi, DopplePaymer, and Egregor often try to exfiltrate information. TAs are then able to demand a separate settlement in exchange for not publishing this data on the dark web. Unfortunately, there exists no method to be certain that stolen data have been completely deleted by the hacker. In fact, in many instances the threat actor has limited control about data custody. Settling an exfiltration ransom does not eliminate the need for seeking the guidance of legal counsel, performing an investigation into which files were compromised, and sending the necessary alerts to impacted entities. Generally, paying an exfiltration ransom is not recommended.

Progent's Background
Progent has provided online and onsite network services throughout the United States for over two decades and has earned Microsoft's Partner designation in the Datacenter and Cloud Productivity practice areas. Progent's roster of subject matter experts (SMEs) includes professionals who have earned high-level certifications in core technologies such as Cisco networking, VMware, and popular distributions of Linux. Progent's cybersecurity experts have earned prestigious certifications including CISA, CISSP, CRISC, and CMMC 2.0. (Refer to certifications earned by Progent consultants). Progent also offers guidance in financial management and Enterprise Resource Planning application software. This breadth of skills allows Progent to identify and integrate the undamaged parts of your information system following a ransomware intrusion and rebuild them quickly into a viable system. Progent has worked with top insurance providers including Chubb to help organizations clean up after ransomware attacks.

Contact Progent about Crypto-Ransomware Settlement Expertise in Providence
To get in touch with Progent about crypto-ransomware settlement services in Providence, call Progent at 800-462-8800 or go to Contact Progent.