Former ransomware negotiator pleads guilty to extortion

On Monday, the U.S. Justice Department announced that Angelo Martino, a former ransomware negotiator, pleaded guilty to helping cybercriminals extort companies in cyberattacks. Martino, who previously worked for the cybersecurity firm DigitalMint, admitted to playing both sides of the negotiation in five different incidents. While ostensibly hired to help victims resolve cyberattacks, Martino admitted to feeding confidential information back to the operators of the ALPHV/BlackCat ransomware gang. This information included the victims’ insurance policy limits and negotiation strategies, which Martino used to maximize the criminals’ payouts in exchange for a cut of the proceeds.

ALPHV/BlackCat operated under a ransomware-as-a-service model—a business model where developers maintain file-locking malware while contractors, acting as affiliates, deploy it in cyberattacks and share the ransom profits. According to prosecutors, Martino acted as an affiliate alongside co-conspirators Kevin Tyler Martin, another former DigitalMint employee, and Ryan Clifford Goldberg, a former incident response manager—a professional responsible for handling cyberattacks—at the cybersecurity firm Sygnia. Martino admitted to helping Goldberg and Martin deploy the ransomware against several victims inside the U.S. for six months in 2023. Prosecutors stated that the co-conspirators made more than $1.2 million from a single victim during this period.

The U.S. Justice Department emphasized the severity of the insider threat. Assistant Attorney General A. Tysen Duva stated, “Angelo Martino’s clients trusted him to respond to ransomware threats and help thwart and remedy them on behalf of victims. Instead, he betrayed them and began launching ransomware attacks himself by assisting cyber criminals and harming victims, his own employer, and the cyber incident response industry itself.” Martino now faces up to 20 years in prison for his role in the extortion scheme. Authorities have already seized $10 million in assets from him.

When reached for comment on Tuesday, an unnamed DigitalMint spokesperson stated that the company had no knowledge of Martino’s criminal actions and fired the employees after learning of the accusations. Martino is the third ransomware negotiator in the past year to face jail for this scheme. The plea follows broader law enforcement actions against the ALPHV/BlackCat group; in 2023, an international coalition of law enforcement authorities seized the gang’s dark web leak site and released a decryption tool that helped more than 500 ALPHV victims restore their systems.

Why it matters

The case highlights a significant insider threat within the cybersecurity industry, where individuals hired to negotiate with ransomware gangs instead exploited their access to assist criminals.