Ransomware Response Services

Progent's Ransomware Settlement Negotiation Services
Progent is experienced in negotiating ransomware settlements with threat actors. Negotiating an optimum settlement is a complicated exercise that calls for a mix of field experience, IT knowledge and business acumen. It also demands working closely with the cyber-extortion target's IT team and the cyber insurance carrier, if any. Since the number one goal of the ransomware target is fast recovery, it is vital to establish response teams that work efficiently, in parallel, and in close communication. Progent offers the breadth of IT knowledge and the depth of personnel to supplement your IT staff and restore your network rapidly and economically.

Services provided by Progent's ransomware settlement negotiation experts include:

• Establishing the type of ransomware used in the attack
• Identifying and communicating with the hacker persona
• Assessing the recovery risk
• Testing the TA's decryption tool
• Deciding on an acceptable settlement range with the ransomware victim and the insurance carrier
• Establishing a settlement and schedule with the hacker
• Checking accordance with anti-money laundering laws
• Managing the crypto-currency disbursement to the TA
• Acquiring, learning, and operating the threat actor's decryption tool
• If needed, contacting the TA for assistance with the decryptor utility

• Isolating infected endpoints and data stores to prevent further spread of the attack
• Creating replicas of every breached server and endpoint and data store in order to perform forensics without interfering with restoration
• Installing anti-virus agents to all clean endpoints
• Restoring files from offline backups or uncompromised machines
• Creating a pristine recovery environment
• Remapping and connecting drives to reflect exactly their pre-encryption condition

Exfiltration Ransoms
Beyond extorting money for a decryption tool, modern variants of ransomware like Ryuk, Sodinokibi, Netwalker, and Egregor commonly attempt to steal (or "exfiltrate") information. TAs are then able to demand an additional ransom in exchange for not posting this data on the dark web. Sadly, there is no method to guarantee that exfiltrated data have been totally deleted by the threat actor. Actually, in many cases the TA has little control about where the information ends up. Settling an exfiltration ransom does not eliminate the necessity of engaging the advice of privacy attorneys, performing an inventory of data were taken, and performing the required notifications to affected entities. Generally, paying an exfiltration ransom is a waste.

Progent's Qualifications
Progent has provided online and on-premises network services throughout the United States for over two decades and has been awarded Microsoft's Partner certification in the Datacenter and Cloud Productivity practice areas. Progent's team of subject matter experts (SMEs) includes consultants who have been awarded advanced certifications in core technologies including Cisco networking, VMware virtualization, and major distributions of Linux. Progent's cybersecurity consultants have earned prestigious certifications such as CISM, CISSP-ISSAP, CRISC, and CMMC 2.0. (See Progent's certifications). Progent also offers top-tier support in financial and ERP applications. This breadth of expertise allows Progent to salvage and consolidate the undamaged pieces of your network after a ransomware assault and reconstruct them rapidly into an operational system. Progent has worked with top cyber insurance carriers including Chubb to help businesses clean up after ransomware attacks.

Contact Progent about Crypto-Ransomware Settlement Negotiation Expertise
To get in touch with Progent about ransomware settlement expertise, phone Progent at 800-462-8800 or go to Contact Progent.