Former Ransomware Negotiator Pleads Guilty to Aiding BlackCat, Betraying Clients
Ransomware Negotiator Admits to Conspiring with BlackCat Gang
Related Entities(initial)
Threat Actors
Other
Full Report(when first published)
Executive Summary
In a stark example of a malicious insider threat, Angelo Martino, a 41-year-old former ransomware negotiator, has pleaded guilty to federal charges of conspiring with the BlackCat (ALPHV) ransomware gang. While employed at DigitalMint, a crypto broker that helps victims pay ransoms, Martino secretly fed the attackers sensitive information about his own clients. This included details about their insurance coverage and internal negotiation limits, allowing BlackCat to extort higher payments. Martino also admitted to actively conspiring in ransomware attacks, betraying the trust of the companies he was hired to help. Authorities have seized approximately $10 million in assets from Martino.
Threat Overview
This case highlights a dangerous evolution of the insider threat, where a trusted security professional actively colludes with a major ransomware group. Martino's role was twofold:
- Aiding Extortion: While negotiating on behalf of victims, he acted as an informant for BlackCat. By revealing a company's true ability to pay (e.g., their cyber insurance limit), he ensured the gang would not settle for a lower amount, thus maximizing the criminals' profit.
- Conspiring in Attacks: Beyond just passing information, Martino admitted to actively conspiring with others to deploy ransomware against U.S. victims, effectively becoming part of the criminal enterprise himself.
The scheme resulted in massive payouts from victims in hospitality, financial services, and non-profit sectors, with some ransoms reaching over $25 million.
Technical Analysis
While this is primarily a story of human betrayal, it intersects with the ransomware TTPs of the BlackCat group.
- Insider Knowledge: Martino's contribution maps to the reconnaissance and resource development phases of an attack. His intel allowed BlackCat to bypass much of the uncertainty in the negotiation process.
- Ransomware Deployment: As a conspirator, Martino was involved in attacks that used standard BlackCat methods, which typically involve gaining access via compromised credentials or vulnerabilities, lateral movement, data exfiltration (
T1048 - Exfiltration Over Alternative Protocol), and finally, data encryption (T1486 - Data Encrypted for Impact). - Money Laundering: After a victim paid a $1.2 million ransom in Bitcoin, the group, including Martino, laundered the funds through a series of transactions (
T1136 - Create Account), a common tactic to obscure the flow of illicit cryptocurrency.
This case demonstrates that the 'human element' in cybersecurity is not just about user error; it can also be about malicious intent from those in positions of trust. It fundamentally changes the threat model for incident response.
Impact Assessment
- For Victims: The companies betrayed by Martino suffered greater financial losses than they might have otherwise. They were negotiating against an opponent who held all the cards.
- For the IR Industry: The case damages the trust between victim organizations and third-party incident response and negotiation firms. Companies will now need to apply greater scrutiny to the partners they hire in a crisis.
- Legal Precedent: The successful prosecution and significant asset seizure send a strong message to any other individuals considering colluding with cybercriminals.
IOCs — Directly from Articles
No technical Indicators of Compromise were provided in the source articles.
Cyber Observables — Hunting Hints
Detecting this type of insider threat is extremely difficult and relies more on behavioral and procedural controls than technical indicators. However, some patterns might be observable:
Detection & Response
- Detection: Detection is less about logs and more about process. Organizations should use multiple, independent parties for different aspects of incident response (e.g., separate firms for forensics, negotiation, and legal counsel) to create checks and balances. Conduct thorough background checks on all third-party IR personnel.
- Response: In a negotiation, never reveal your upper limit or insurance coverage to your negotiator. Treat it as privileged information shared only with legal counsel. If collusion is suspected, immediately engage law enforcement and a new, vetted IR partner.
Mitigation
- Due Diligence: Conduct extreme due diligence when selecting a third-party incident response or negotiation firm. Check references, a history of successful engagements, and their standing in the security community.
- Compartmentalize Information: During an incident, strictly compartmentalize information. The negotiation team does not need to know the full technical details from the forensics team, and vice versa. Your maximum payment authority should be known only to executive leadership and legal counsel.
- Involve Law Enforcement: Engage law enforcement (such as the FBI) early in a major ransomware incident. They have resources and intelligence that can help identify and pursue the actors, as demonstrated in this case.
- Internal Controls: For IR firms, implement strict internal controls, codes of conduct, and regular audits to prevent this type of malicious activity. This includes monitoring employee communications and financial activities where legally permissible.
Timeline of Events
Article Updates
May 1, 2026
Severity increasedTwo cybersecurity professionals, Ryan Goldberg and Kevin Martin, sentenced to 4 years for acting as BlackCat affiliates, conducting attacks and leaking patient data.
Ryan Goldberg and Kevin Martin, two cybersecurity professionals, have been sentenced to four years in prison for their roles as BlackCat/ALPHV ransomware affiliates. They conducted full-lifecycle attacks, including initial compromise, data exfiltration, encryption, and extortion, between April and December 2023. Their activities included targeting a healthcare provider and leaking sensitive patient data. This sentencing highlights the severe consequences for insiders abusing their expertise and expands on the ongoing narrative of professionals collaborating with BlackCat, further detailing the scope of the criminal enterprise.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.