Sometimes yes, but this is not the case most of the times.

But there are methods that can be used to save your files and our team can help you research all possible ways to recover your files without the hackers’ help and if all fails, then we can discuss the next steps.

Our protocol is first to freeze time, take backups of your whole infrastructure so we can have time to examine the options we have.

Sometimes after we backup your infrastructure we will be able to identify some things that may help you avoid the ransomware payment.

• We may be able to find a decryptor
• We may be able to find the encryption key of the ransomware
• We may be able to identify that there is a bug in the Ransomware script and we can recover your data without payment
• We may be able to perform data recovery
• We may be able to reconstruct your databases depending on the Ransomware Family and how your files have been encrypted

But even if you decide to pay the hackers you should know if they are trustful or not, because most of the time they ask for huge amount of money, paid in Bitcoin or Monero.

What we have seen is that if your company handles the communication with them and the execution of the decryptor there are many cases that end up badly.

• Hackers may be still inside your infrastructure and might encrypt your endpoints again
• The IT administrator may do some panic actions due to pressure and destroy the initial state of the infrastructure. In fact we see that in 10% of the cases.
• The decryptor that you buy from the hacker might corrupt the files instead of decrypting them because it wasn’t run according to instructions.
• The cyber criminal might disappear after payment or even get arrested.
• Hard disk or Raid Systems might fail when you have the decryptor, so no files can be decrypted.

We offer a holistic approach to Ransomware that will help you get back to business as quickly as possible and also protect your infrastructure in the future.

Lets see how we can help you:

1. You start here by reporting your ransomware incident to our team for a completely free assessment and consultation call from our cyber security experts team.
2. After we study carefully your submission we will inform you on what are the available options we have and what our strategy is.
3. If your infrastructure is complicated, we might as for an additional Zoom or Skype Conference with your team.
4. It’s very important to NOT contact the hacker and NOT do any action on the endpoints rather than shutting them down and disconnecting them from your network.

1. We will talk with the management
2. We will talk with the IT department
3. We will coordinate simultaneous tasks in order to keep all options open, even the option to pay the hacker, but it will be your choice in the end if all else fails
4. We will ask you if you want to know how and when the attack happened. In that case we will perform Digital Forensics in your infrastructure.
5. We will ask you if you want to protect your current assets, given the fact that the hacker might be still inside your network.
6. According to the selected actions that will be chosen by the management we will move forward.

Our team of expert Ransomware negotiators can greatly help you along with our vast experience with Ransomware Families.

Imagine the role of the Ransomware Negotiator as an inhouse person that tries to negotiate the price from your side.

After we do an initial Zoom meeting we understand your needs and the criticality of your data in order to achieve better results in the Ransomware Negotiation.

Depending on the ransomware family we can decrease the price of the initial ransomware request from 10% to up to 90%. But this depends on our previous experience.

Our primary goal is to get a decryptor as fast as possible, decrease the downtime of your organisation and achieve the best price possible.

We do this by having the following tools:

• Database of threat intelligence that identifies the behavioural analysis of most ransomware families
• Previous negotiation outcomes
• We know the limits of cyber criminals. Every attack has a cost and some expenses from the side of the cyber criminal and also they need to make a profit. If you cross the line you lose communication

1. We will take care of your backups of the existing infrastructure, because you don’t know if another hacker can use the same path to jump in.
2. If you chose so, we have the capability to install protection and monitoring agent software in your premises, in order to identify any new threats that might wake up
3. We will remove the malware and guarantee that it will not run again while we are helping you recover your business.

If you already have a Cyber Security Contract, then you are in good hands since almost everything will be covered by your Insurance Contract and we will guarantee that everything will be documented for smooth processing of your claim.