Former Ransomware Negotiator Sentenced to 4 Years for BlackCat Attacks

Post Views: 15

A former cybersecurity incident response professional has received a 70-month prison sentence for involvement in BlackCat (ALPHV) ransomware attacks targeting U.S. organizations.

Background of the Case

The individual, identified as Angelo Martino, was part of a group that executed cyberattacks between April 2023 and April 2025, collaborating with accomplices Ryan Clifford Goldberg and Kevin Tyler Martin. The three individuals, former employees of Sygnia and DigitalMint, were charged with conspiracy to obstruct commerce through extortion.

The BlackCat Ransomware Group

Martino and his co-defendants admitted to demanding ransom payments while threatening to expose stolen data before encrypting systems. The FBI reported that the BlackCat ransomware collective was responsible for over 60 breaches between November 2021 and March 2022. By September 2023, the group had collected at least $300 million in ransom payments from more than 1,000 victims.

Martino’s Role

Martino’s role included sharing sensitive information about victim insurance policies and negotiation strategies with BlackCat operators, enabling the cybercriminals to maximize extortions. Specific victims included a financial services firm that paid $25.66 million and a nonprofit organization that surrendered $26.79 million. Additional targets encompassed school districts, medical facilities, law firms, and other financial entities.

Legal Consequences and Sentences

Martino, 41, was initially referred to as “Co-Conspirator 1” in an October 2025 indictment. His identity was revealed in court documents unsealed in March 2026. Martin and Goldberg, who pleaded guilty in December 2025, each received four-year sentences in May 2026. The trio paid BlackCat administrators 20% of all ransom proceeds in exchange for access to the ransomware platform.

Company Response

DigitalMint’s CEO, Jonathan Solomon, stated the company condemned the former employees’ actions, emphasizing their immediate termination upon discovery of the misconduct. “These individuals violated our values, ethical standards, and legal obligations,” Solomon said.

Impact and Broader Implications

The case highlights the intersection of cybersecurity professionals and criminal activities, underscoring the risks of insider threats. Law enforcement agencies continue to track ransomware operations, with the BlackCat group remaining a significant focus due to its scale and financial impact.

“These individuals violated our values, ethical standards, and legal obligations,” Solomon said.

Conclusion

This case underscores the growing threat of ransomware and the critical need for vigilance in cybersecurity. The collaboration between former professionals and criminal networks demonstrates the evolving nature of cybercrime and the importance of robust legal and organizational safeguards.