Ransomware Solutions Services

Overview of Progent's Ransomware Negotiation Services in St. Paul
Progent has experience negotiating ransomware settlements with threat actors. Negotiating an acceptable settlement is a complex activity that requires a combination of field experience, technical skills and business savvy. It also calls for close co-operation with the ransomware victim's IT team and the cyber insurance provider, if any. Since the top goal of the ransomware victim is operational continuity, it is vital to deploy recovery teams that work efficiently, in parallel, and in close communication. Progent has the scope of IT skills and the deep bench of personnel to supplement your network staff and recover your network environment rapidly and economically.

Services offered by Progent's ransomware settlement negotiation experts include:

• Establishing the type of ransomware used in the assault
• Making contact with the hacker
• Evaluating the likelihood of recovery
• Verifying the hacker's decryption capabilities
• Deciding on an acceptable settlement payment with the ransomware victim and the insurance carrier
• Establishing a settlement amount and schedule with the threat actor
• Checking adherence to anti-money laundering (AML) laws
• Managing the crypto-currency transfer to the hacker
• Receiving, reviewing, and using the TA's decryptor mechanism
• If necessary, contacting the hacker for technical help with the decryptor tool

• Quarantining affected endpoints to prevent further spread of the attack
• Creating replicas of every breached server and endpoint and data store in order to perform forensics in parallel with cleanup
• Installing A/V protection to all virus-free endpoints
• Recovering data from offline backups or unscathed endpoints
• Creating a pristine recovery environment
• Remapping and connecting datastores to match exactly their pre-encryption state

Settling Exfiltration Ransoms
Beyond demanding money for a decryption utility, modern strains of crypto-ransomware such as Ryuk, Maze, DopplePaymer, and Egregor commonly try to exfiltrate files. TAs can then demand an extra payment in exchange for not posting this information on the dark web. Unfortunately, there exists no method to prove that exfiltrated data have been completely deleted by the TA. In fact, in numerous cases the TA has limited control about where the information ends up. Paying an exfiltration ransom does not free you from the need for seeking the guidance of legal counsel, performing an investigation into which data were taken, and performing the mandated alerts to impacted entities. Generally, paying an exfiltration ransom is a waste.

Progent's Qualifications
Progent has delivered online and on-premises IT services throughout the U.S. for more than two decades and has been awarded Microsoft's Partner designation in the Datacenter and Cloud Productivity competencies. Progent's team of SMEs includes professionals who have been awarded high-level certifications in core technology platforms such as Cisco infrastructure, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have earned internationally recognized certifications including CISA, CISSP-ISSAP, GIAC, and CMMC 2.0. (Refer to certifications earned by Progent consultants). Progent also offers guidance in financial and ERP software. This broad array of expertise allows Progent to salvage and integrate the surviving parts of your network following a ransomware intrusion and rebuild them quickly into a functioning network. Progent has worked with top insurance providers like Chubb to help businesses clean up after ransomware attacks.

Contact Progent about Ransomware Settlement Expertise in St. Paul
To get in touch with Progent about crypto-ransomware settlement expertise in St. Paul, phone Progent at 800-462-8800 or go to Contact Progent.