Ransomware Response Consulting Services

Overview of Progent's Ransomware Negotiation Consulting in Curitiba
Progent has experience negotiating ransomware settlements with hackers. Negotiating an acceptable settlement is a complicated activity that requires a mix of field experience, IT skills and business savvy. It also calls for close co-operation with the victim's IT staff and the insurance provider, if any. Because the number one priority of the ransomware victim is operational continuity, it is critical to deploy recovery teams that work effectively, concurrently, and with intimate collaboration. Progent has the scope of IT skills and the deep bench of personnel to complement your network support team and recover your network quickly and affordably.

Support offered by Progent's ransomware negotiation experts include:

• Establishing the kind of ransomware involved in the attack
• Identifying and communicating with the hacker persona
• Evaluating the recovery risk
• Validating the hacker's decryption tool
• Deciding on an acceptable settlement amount with the ransomware victim and the cyber insurance carrier
• Establishing a settlement and schedule with the hacker
• Confirming accordance with anti-money laundering (AML) laws
• Overseeing the crypto-currency transfer to the TA
• Acquiring, learning, and operating the TA's decryptor mechanism
• If necessary, contacting the threat actor for technical help with the decryptor utility

• Quarantining infected endpoints to arrest the spread of the assault
• Creating replicas of each breached server and endpoint and data store to allow forensics in parallel with recovery
• Adding anti-virus agents to all clean endpoints
• Salvaging files from air-gapped backups or uncompromised machines
• Building a clean environment
• Remapping and connecting drives to match precisely their pre-attack state

Exfiltration Ransoms
Beyond demanding money for a decryption tool, modern variants of ransomware such as Ryuk, Sodinokibi, DopplePaymer, and Nephilim often try to steal (or "exfiltrate") files. TAs can then demand a separate ransom for not posting this data on the dark web. Unfortunately, there is no method to guarantee that stolen data have been completely erased by the hacker. Actually, in numerous cases the threat actor has limited control over who can access the stolen files. Settling an exfiltration ransom does not free you from the need for engaging the guidance of legal counsel, performing an audit on which files were compromised, and performing the required alerts to impacted entities. In almost all cases, paying an exfiltration ransom is not recommended.

Progent's Background
Progent has delivered online and on-premises IT services throughout the U.S. for more than 20 years and has been awarded Microsoft's Partner certification in the Datacenter and Cloud Productivity competencies. Progent's roster of subject matter experts (SMEs) includes consultants who have earned high-level certifications in core technologies including Cisco infrastructure, VMware, and popular Linux distros. Progent's cybersecurity consultants have earned prestigious certifications such as CISA, CISSP, GIAC, and CMMC 2.0. (Refer to certifications earned by Progent consultants). Progent also has top-tier support in financial and ERP applications. This broad array of skills gives Progent the ability to identify and integrate the surviving pieces of your IT environment following a ransomware attack and rebuild them quickly into an operational network. Progent has collaborated with leading insurance providers including Chubb to assist businesses clean up after ransomware attacks.

Contact Progent about Ransomware Settlement Negotiation Expertise in Curitiba
To contact with Progent about crypto-ransomware settlement expertise in Curitiba, phone Progent at 800-462-8800 or go to Contact Progent.