Ransomware Response Consulting Services

Overview of Progent's Ransomware Negotiation Consulting in São Paulo
Progent is experienced in negotiating ransomware settlements with attackers. Negotiating an acceptable settlement is a complicated exercise that requires a combination of field experience, technical skills and business acumen. It also calls for working closely with the victim's IT team and the insurance provider, if any. Because the number one goal of the ransomware target is operational continuity, it is vital to deploy recovery groups that operate effectively, in parallel, and with intimate collaboration. Progent has the scope of IT knowledge and the deep bench of personnel to complement your IT support team and recover your network environment rapidly and economically.

Support provided by Progent's ransomware settlement experts include:

• Establishing the kind of ransomware involved in the attack
• Identifying and communicating with the hacker persona
• Evaluating the recovery risk
• Testing the threat actor's decryption tool
• Determining a settlement with the ransomware victim and the insurance provider
• Negotiating a settlement amount and timeline with the hacker
• Verifying adherence to anti-money laundering (AML) regulations
• Overseeing the crypto-currency disbursement to the TA
• Acquiring, reviewing, and operating the TA's decryptor mechanism
• If needed, contacting the TA for technical assistance with the decryptor tool

• Isolating infected endpoints and data stores to prevent further progress of the attack
• Creating digital copies of every compromised server and endpoint and data store to allow forensics without interfering with cleanup
• Installing anti-virus protection to all clean endpoints
• Restoring data from air-gapped restores or unscathed machines
• Creating a clean environment
• Mapping and connecting drives to reflect exactly their pre-encryption state

Settling Exfiltration Ransoms
Beyond demanding money for a decryption utility, current strains of ransomware such as Ryuk, Sodinokibi, DopplePaymer, and Egregor often attempt to exfiltrate information. Hackers are then able to demand an additional payment in exchange for not divulging this data or selling it. Sadly, there is no way to prove that stolen data have been totally erased by the threat actor. In fact, in numerous cases the TA has little control about who can access the stolen files. Paying an exfiltration ransom does not free you from the need for engaging the advice of legal counsel, performing an investigation into which files were compromised, and carrying out the required alerts to affected entities. Generally, paying an exfiltration ransom is a waste.

Progent's Background
Progent has provided remote and onsite network services throughout the U.S. for over 20 years and has earned Microsoft's Partner certification in the Datacenter and Cloud Productivity practice areas. Progent's team of subject matter experts (SMEs) includes professionals who have earned advanced certifications in foundation technology platforms including Cisco infrastructure, VMware virtualization, and popular distributions of Linux. Progent's cybersecurity experts have earned prestigious certifications such as CISM, CISSP-ISSAP, CRISC, and CMMC 2.0. (Refer to certifications earned by Progent consultants). Progent also offers top-tier support in financial and Enterprise Resource Planning software. This scope of expertise gives Progent the ability to salvage and integrate the surviving parts of your IT environment after a ransomware attack and rebuild them quickly into an operational system. Progent has worked with top cyber insurance providers like Chubb to assist businesses clean up after ransomware attacks.

Contact Progent about Crypto-Ransomware Settlement Services in São Paulo
To get in touch with Progent about crypto-ransomware settlement services in São Paulo, call Progent at 800-462-8800 or go to Contact Progent.