Ransomware Response Services

Overview of Progent's Ransomware Forensics and Reporting
Progent's ransomware forensics experts can capture the evidence of a ransomware attack and carry out a detailed forensics investigation without disrupting the processes related to operational resumption and data recovery. You can use Progent's post-attack forensics documentation to counter future ransomware assaults, assist in the cleanup of encrypted data, and meet insurance and regulatory requirements.

Ransomware forensics analysis is aimed at determining and describing the ransomware assault's progress across the targeted network from start to finish. This audit trail of how a ransomware assault travelled within the network assists you to assess the impact and uncovers vulnerabilities in policies or processes that need to be corrected to avoid future breaches. Forensics is typically assigned a top priority by the insurance carrier and is often mandated by state and industry regulations. Because forensics can take time, it is critical that other important activities like operational resumption are performed concurrently. Progent maintains an extensive team of information technology and security professionals with the skills needed to perform activities for containment, operational resumption, and data restoration without disrupting forensics.

Ransomware forensics is arduous and requires close interaction with the groups responsible for file restoration and, if needed, settlement talks with the ransomware attacker. Forensics typically require the examination of all logs, registry, GPO, AD, DNS, routers, firewalls, schedulers, and basic Windows systems to look for variations.

Activities involved with forensics include:

• Isolate without shutting down all potentially affected devices from the system. This can require closing all RDP ports and Internet connected NAS storage, modifying admin credentials and user passwords, and setting up 2FA to secure your backups.
• Preserve forensically sound duplicates of all suspect devices so the data recovery team can get started
• Preserve firewall, virtual private network, and additional key logs as quickly as possible
• Identify the version of ransomware used in the assault
• Examine every machine and data store on the system including cloud storage for signs of compromise
• Inventory all compromised devices
• Determine the kind of ransomware used in the attack
• Study log activity and sessions in order to establish the time frame of the ransomware assault and to identify any potential sideways movement from the first infected system
• Understand the attack vectors used to carry out the ransomware assault
• Search for the creation of executables associated with the first encrypted files or network compromise
• Parse Outlook PST files
• Analyze email attachments
• Separate any URLs embedded in email messages and check to see if they are malicious
• Provide comprehensive attack documentation to satisfy your insurance and compliance regulations
• Document recommendations to shore up cybersecurity gaps and enforce processes that reduce the risk of a future ransomware breach

Contact Progent about Progent's Ransomware Forensics Expertise
To learn more information about ways Progent can help you with ransomware forensics, call 1-800-462-8800 or see Contact Progent.