Ransomware Response Consultants

Overview of Progent's Ransomware Settlement Negotiation Services in Mobile
Progent is experienced in negotiating ransomware settlements with attackers. Negotiating an optimum settlement is a complex exercise that calls for a mix of field experience, technical skills and business savvy. It also requires working closely with the cyber-extortion target's IT team and the insurance provider, if any. Because the top priority of the ransomware victim is operational continuity, it is vital to deploy recovery groups that work effectively, concurrently, and in close communication. Progent offers the breadth of IT knowledge and the deep bench of experts to complement your network support team and restore your network environment rapidly and economically.

Support offered by Progent's ransomware negotiation team include:

• Establishing the kind of ransomware involved in the assault
• Identifying and contacting the hacker
• Assessing the likelihood of recovery
• Validating the hacker's decryption tool
• Agreeing on a settlement amount with the ransomware victim and the insurance carrier
• Negotiating a settlement and timeline with the threat actor
• Checking accordance with anti-money laundering sanctions
• Managing the crypto-currency payment to the hacker
• Receiving, learning, and using the threat actor's decryptor tool
• If needed, contacting the TA for assistance with the decryptor tool

• Quarantining infected endpoints to arrest the spread of the assault
• Creating digital copies of each compromised server and endpoint and data store to allow forensics without interfering with restoration
• Installing A/V agents to all virus-free endpoints
• Salvaging files from air-gapped backups or uncompromised endpoints
• Creating a pristine environment
• Remapping and reconnecting drives to reflect exactly their pre-encryption condition

Settling Exfiltration Ransoms
In addition to extorting payment for a decryption utility, current strains of crypto-ransomware like Ryuk, Sodinokibi, DopplePaymer, and Nephilim often attempt to steal (or "exfiltrate") information. TAs can then demand an additional ransom in exchange for not posting this information on the dark web. Sadly, there is no method to be certain that exfiltrated data have been totally erased by the threat actor. In fact, in numerous cases the TA has limited say about who can access the stolen files. Paying an exfiltration ransom does not free you from the need for getting the advice of legal counsel, performing an investigation into which files were stolen, and sending the necessary alerts to affected entities. In almost all cases, paying an exfiltration ransom is not recommended.

Progent's Background
Progent has provided online and on-premises IT services throughout the U.S. for over two decades and has earned Microsoft's Partner certification in the Datacenter and Cloud Productivity competencies. Progent's roster of SMEs includes consultants who have earned advanced certifications in core technology platforms including Cisco infrastructure, VMware, and major distributions of Linux. Progent's cybersecurity consultants have earned industry-recognized certifications including CISM, CISSP, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also offers guidance in financial and Enterprise Resource Planning applications. This breadth of skills allows Progent to identify and consolidate the undamaged pieces of your information system after a ransomware assault and reconstruct them quickly into a functioning network. Progent has collaborated with top insurance carriers like Chubb to assist organizations clean up after ransomware attacks.

Contact Progent about Ransomware Settlement Negotiation Guidance in Mobile
To contact with Progent about crypto-ransomware settlement negotiation services in Mobile, call Progent at 800-462-8800 or go to Contact Progent.