Ransomware Response Services
Crypto-Ransomware Negotiation Experts
Progent's Ransomware Settlement Negotiation Consulting in Lincoln
Progent has experience negotiating ransomware settlements with adversaries. Negotiating an optimum settlement is a complicated activity that calls for a combination of real-word experience, IT knowledge and business acumen. It also demands working closely with the victim's IT team and the cyber insurance provider, if any. Because the top priority of the ransomware victim is operational continuity, it is critical to establish response teams that operate effectively, concurrently, and with intimate collaboration. Progent has the breadth of technical skills and the depth of personnel to supplement your network staff and restore your network environment quickly and affordably.
Support offered by Progent's ransomware negotiation team include:
- Determining the type of ransomware involved in the attack
- Identifying and communicating with the hacker persona
- Evaluating the likelihood of recovery
- Testing the threat actor's decryption capabilities
- Deciding on an acceptable settlement payment with the ransomware victim and the cyber insurance carrier
- Negotiating a settlement and schedule with the TA
- Verifying compliance with anti-money laundering (AML) sanctions
- Carrying out the crypto-currency transfer to the TA
- Acquiring, learning, and operating the TA's decryption tool
- If necessary, contacting the threat actor for assistance with the decryptor tool
- Quarantining affected endpoints and data stores to prevent further progress of the attack
- Making replicas of each compromised server and endpoint and data store in order to perform forensics without interfering with restoration
- Adding A/V protection to all clean endpoints
- Recovering files from air-gapped restores or unscathed endpoints
- Building a pristine recovery environment
- Mapping and reconnecting drives to reflect exactly their pre-encryption state
Exfiltration Ransoms
Beyond demanding payment for a decryption tool, modern variants of ransomware like Ryuk, Maze, DopplePaymer, and Nephilim often try to steal (or "exfiltrate") files. TAs can then demand an additional payment for not posting this information on the dark web. Sadly, there exists no method to be certain that exfiltrated data have been completely erased by the TA. In fact, in many cases the threat actor has little control over data custody. Settling an exfiltration ransom does not free you from the need for getting the guidance of legal counsel, conducting an inventory of files were taken, and performing the mandated alerts to impacted entities. In almost all cases, paying an exfiltration ransom is a waste.
Progent's Background
Progent has provided online and onsite network services across the U.S. for more than two decades and has been awarded Microsoft's Partner designation in the Datacenter and Cloud Productivity practice areas. Progent's team of SMEs includes professionals who have earned high-level certifications in foundation technologies including Cisco networking, VMware virtualization, and major Linux distros. Progent's cybersecurity consultants have earned industry-recognized certifications such as CISA, CISSP, CRISC, and CMMC 2.0. (See Progent's certifications). Progent also offers top-tier support in financial management and ERP software. This breadth of skills gives Progent the ability to salvage and consolidate the surviving pieces of your network following a ransomware attack and reconstruct them quickly into an operational network. Progent has collaborated with top insurance carriers like Chubb to assist organizations recover from ransomware attacks.
Contact Progent about Crypto-Ransomware Settlement Services in Lincoln
To get in touch with Progent about ransomware settlement expertise in Lincoln, phone Progent at
Select Topic: