Ransomware Response Services

Progent's Ransomware Settlement Negotiation Consulting in Addison
Progent has experience negotiating ransomware settlements with hackers. Negotiating an optimum settlement is a complex exercise that calls for a mix of field experience, IT skills and business savvy. It also requires working closely with the victim's IT staff and the cyber insurance provider, if there is one. Because the number one priority of the ransomware target is operational continuity, it is critical to deploy recovery teams that operate efficiently, in parallel, and in close communication. Progent has the scope of IT knowledge and the deep bench of experts to supplement your IT support team and recover your network rapidly and affordably.

Support offered by Progent's ransomware settlement team include:

• Establishing the kind of ransomware involved in the assault
• Identifying and contacting the hacker
• Evaluating the recovery risk
• Verifying the threat actor's decryption capabilities
• Determining a settlement payment with the victim and the cyber insurance provider
• Establishing a settlement and schedule with the hacker
• Checking adherence to anti-money laundering sanctions
• Overseeing the crypto-currency disbursement to the TA
• Receiving, reviewing, and using the hacker's decryption tool
• If needed, contacting the TA for technical assistance with the decryptor tool

• Isolating infected endpoints and data stores to arrest the spread of the attack
• Creating digital copies of every breached device and data store in order to perform forensics in parallel with recovery
• Installing anti-virus protection to all clean endpoints
• Recovering data from offline backups or uncompromised endpoints
• Creating a clean recovery environment
• Mapping and reconnecting drives to match precisely their pre-encryption state

Paying Exfiltration Ransoms
In addition to extorting payment for a decryption tool, current variants of crypto-ransomware like Ryuk, Maze, DopplePaymer, and Egregor commonly try to exfiltrate information. TAs can then demand an additional payment in exchange for not publishing this information on the dark web. Unfortunately, there exists no way to prove that stolen data have been completely erased by the TA. Actually, in many cases the threat actor has little say over who can access the stolen files. Settling an exfiltration ransom does not eliminate the need for engaging the advice of privacy lawyers, conducting an investigation into which data were taken, and performing the necessary alerts to affected entities. Generally, paying an exfiltration ransom is not recommended.

Progent's Qualifications
Progent has delivered remote and on-premises network services throughout the United States for over 20 years and has been awarded Microsoft's Partner designation in the Datacenter and Cloud Productivity practice areas. Progent's roster of subject matter experts (SMEs) includes consultants who have been awarded high-level certifications in core technology platforms such as Cisco infrastructure, VMware virtualization, and popular Linux distros. Progent's data security consultants have earned industry-recognized certifications such as CISA, CISSP, CRISC, and CMMC 2.0. (See Progent's certifications). Progent also offers guidance in financial and ERP applications. This breadth of skills allows Progent to salvage and integrate the surviving pieces of your IT environment after a ransomware attack and reconstruct them quickly into an operational system. Progent has collaborated with top cyber insurance providers like Chubb to help organizations recover from ransomware assaults.

Contact Progent about Crypto-Ransomware Settlement Guidance in Addison
To get in touch with Progent about crypto-ransomware settlement negotiation expertise in Addison, phone Progent at 800-462-8800 or go to Contact Progent.