Ransomware Response Consultants

Progent's Ransomware Negotiation Consulting in Yonkers
Progent has experience negotiating ransomware settlements with adversaries. Reaching an acceptable settlement is a complicated activity that calls for a combination of field experience, technical skills and business acumen. It also demands working closely with the victim's IT team and the cyber insurance carrier, if any. Since the top priority of the ransomware victim is operational continuity, it is vital to establish response teams that work efficiently, in parallel, and in close communication. Progent offers the breadth of IT knowledge and the depth of personnel to complement your network staff and recover your network environment quickly and economically.

Services provided by Progent's ransomware negotiation team include:

• Establishing the type of ransomware involved in the assault
• Identifying and contacting the hacker persona
• Evaluating the likelihood of recovery
• Testing the hacker's decryption capabilities
• Determining a settlement payment with the victim and the cyber insurance carrier
• Establishing a settlement amount and schedule with the hacker
• Checking compliance with anti-money laundering sanctions
• Overseeing the crypto-currency payment to the hacker
• Receiving, learning, and using the TA's decryptor utility
• If necessary, contacting the threat actor for technical help with the decryptor utility

• Isolating infected endpoints and data stores to prevent further spread of the assault
• Making digital copies of each infected device and data store to allow forensics in parallel with restoration
• Adding A/V agents to all virus-free endpoints
• Restoring files from offline backups or uncompromised machines
• Building a clean environment
• Mapping and reconnecting datastores to reflect exactly their pre-encryption state

Paying Exfiltration Ransoms
Beyond extorting payment for a decryption tool, modern variants of crypto-ransomware like Ryuk, Maze, DopplePaymer, and Nephilim commonly attempt to steal (or "exfiltrate") information. TAs are then able to require a separate settlement for not posting this information or selling it. Sadly, there is no method to guarantee that stolen data have been completely deleted by the threat actor. Actually, in many instances the TA has little say over the disposition of the data. Paying an exfiltration ransom does not eliminate the need for getting the advice of legal counsel, conducting an investigation into which files were stolen, and performing the necessary alerts to affected entities. Generally, paying an exfiltration ransom is a waste.

Progent's Qualifications
Progent has provided online and onsite network services throughout the U.S. for over 20 years and has been awarded Microsoft's Partner designation in the Datacenter and Cloud Productivity competencies. Progent's roster of subject matter experts (SMEs) includes professionals who have earned advanced certifications in foundation technology platforms such as Cisco infrastructure, VMware virtualization, and major distributions of Linux. Progent's cybersecurity experts have earned internationally recognized certifications including CISA, CISSP-ISSAP, CRISC, and CMMC 2.0. (See certifications earned by Progent consultants). Progent also offers guidance in financial and ERP application software. This broad array of expertise gives Progent the ability to identify and consolidate the undamaged pieces of your network following a ransomware intrusion and rebuild them rapidly into an operational system. Progent has worked with leading insurance carriers including Chubb to help businesses recover from ransomware attacks.

Contact Progent about Ransomware Settlement Services in Yonkers
To get in touch with Progent about ransomware settlement negotiation expertise in Yonkers, phone Progent at 800-462-8800 or go to Contact Progent.