Ransomware Response Services

Progent's Ransomware Negotiation Consulting in St. Louis
Progent is experienced in negotiating ransomware settlements with hackers. Reaching an acceptable settlement is a complex exercise that requires a combination of field experience, IT knowledge and business savvy. It also requires working closely with the cyber-extortion target's IT team and the insurance provider, if any. Because the top priority of the ransomware target is operational continuity, it is critical to deploy response groups that operate efficiently, concurrently, and with intimate collaboration. Progent has the breadth of IT knowledge and the deep bench of personnel to complement your IT staff and recover your network environment quickly and affordably.

Support available from Progent's ransomware settlement negotiation experts include:

• Establishing the kind of ransomware used in the attack
• Identifying and communicating with the hacker
• Assessing the likelihood of recovery
• Testing the TA's decryption tool
• Deciding on an acceptable settlement payment with the ransomware victim and the cyber insurance carrier
• Negotiating a settlement amount and timeline with the threat actor
• Confirming accordance with anti-money laundering (AML) regulations
• Managing the crypto-currency disbursement to the hacker
• Acquiring, reviewing, and operating the TA's decryption tool
• If necessary, contacting the hacker for technical assistance with the decryptor utility

• Isolating infected endpoints to arrest the spread of the attack
• Creating digital copies of each breached device and data store to allow forensics in parallel with restoration
• Adding A/V agents to all clean endpoints
• Salvaging data from air-gapped backups or uncompromised machines
• Creating a pristine environment
• Mapping and connecting drives to match precisely their pre-encryption state

Settling Exfiltration Ransoms
In addition to extorting money for a decryption tool, modern strains of ransomware such as Ryuk, Sodinokibi, Netwalker, and Egregor commonly try to steal (or "exfiltrate") information. Hackers are then able to require an extra ransom for not posting this information on the dark web. Sadly, there is no way to guarantee that stolen data have been totally deleted by the TA. In fact, in numerous instances the threat actor has little control over the disposition of the data. Paying an exfiltration ransom does not eliminate the need for getting the advice of legal counsel, conducting an investigation into which files were stolen, and carrying out the mandated notifications to impacted entities. In general, paying an exfiltration ransom is not recommended.

Progent's Qualifications
Progent has provided online and on-premises IT services across the U.S. for more than two decades and has been awarded Microsoft's Partner certification in the Datacenter and Cloud Productivity practice areas. Progent's roster of subject matter experts includes professionals who have been awarded high-level certifications in foundation technology platforms such as Cisco infrastructure, VMware, and popular Linux distros. Progent's data security consultants have earned industry-recognized certifications including CISM, CISSP-ISSAP, GIAC, and CMMC 2.0. (Refer to certifications earned by Progent consultants). Progent also offers top-tier support in financial management and ERP application software. This breadth of expertise gives Progent the ability to identify and integrate the undamaged pieces of your network after a ransomware intrusion and rebuild them rapidly into a functioning system. Progent has worked with leading insurance providers like Chubb to assist businesses recover from ransomware assaults.

Contact Progent about Ransomware Settlement Negotiation Guidance in St. Louis
To get in touch with Progent about ransomware settlement negotiation guidance in St. Louis, call Progent at 800-462-8800 or go to Contact Progent.