Ransomware Response Consultants

Overview of Progent's Ransomware Settlement Negotiation Services in Winston-Salem
Progent is experienced in negotiating ransomware settlements with adversaries. Reaching an acceptable settlement is a complex exercise that calls for a combination of field experience, technical skills and business acumen. It also demands working closely with the ransomware victim's IT staff and the cyber insurance provider, if any. Because the number one goal of the ransomware target is operational continuity, it is vital to deploy recovery groups that operate effectively, in parallel, and in close communication. Progent has the breadth of IT knowledge and the depth of experts to complement your network staff and recover your network rapidly and economically.

Support available from Progent's ransomware settlement team include:

• Determining the type of ransomware involved in the assault
• Making contact with the hacker persona
• Assessing the recovery risk
• Verifying the TA's decryption capabilities
• Deciding on an acceptable settlement with the victim and the cyber insurance provider
• Negotiating a settlement amount and schedule with the threat actor
• Verifying adherence to anti-money laundering laws
• Overseeing the crypto-currency disbursement to the hacker
• Acquiring, learning, and operating the TA's decryptor mechanism
• If necessary, contacting the hacker for technical assistance with the decryption utility

• Quarantining infected endpoints and data stores to arrest the spread of the attack
• Creating replicas of each compromised device and data store to allow forensics in parallel with restoration
• Adding A/V agents to all clean endpoints
• Salvaging files from air-gapped backups or unscathed endpoints
• Building a clean recovery environment
• Mapping and reconnecting drives to reflect precisely their pre-attack condition

Paying Exfiltration Ransoms
Beyond extorting money for a decryption tool, modern strains of crypto-ransomware such as Ryuk, Sodinokibi, DopplePaymer, and Nephilim often try to exfiltrate information. TAs are then able to require an additional payment for not divulging this information on the dark web. Sadly, there is no method to prove that exfiltrated files have been totally erased by the threat actor. Actually, in many instances the hacker has limited control over data custody. Settling an exfiltration ransom does not eliminate the need for getting the guidance of privacy attorneys, performing an investigation into which files were compromised, and performing the required alerts to affected entities. In general, paying an exfiltration ransom is not recommended.

Progent's Qualifications
Progent has provided online and onsite IT services throughout the United States for more than two decades and has been awarded Microsoft's Partner designation in the Datacenter and Cloud Productivity practice areas. Progent's roster of SMEs includes consultants who have been awarded high-level certifications in core technology platforms including Cisco infrastructure, VMware, and major Linux distros. Progent's data security consultants have earned industry-recognized certifications such as CISM, CISSP, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has guidance in financial management and ERP applications. This broad array of expertise allows Progent to salvage and integrate the undamaged pieces of your IT environment following a ransomware intrusion and reconstruct them quickly into a functioning network. Progent has worked with leading cyber insurance providers including Chubb to assist organizations clean up after ransomware attacks.

Contact Progent about Ransomware Settlement Services in Winston-Salem
To get in touch with Progent about crypto-ransomware settlement negotiation guidance in Winston-Salem, phone Progent at 800-462-8800 or go to Contact Progent.