Ransomware negotiator pleads guilty to helping ransomware gang

Angelo Martino, a former ransomware negotiator, has pleaded guilty to helping cybercriminals extort companies in cyberattacks.

The US Department of Justice announced the guilty plea on Monday. Martino, who worked at cybersecurity firm DigitalMint, admitted to playing both sides of the negotiations in five different incidents. While ostensibly working on behalf of victims, Martino admitted to providing confidential information to ALPHV/BlackCat ransomware operators, providing them with information such as the limits of the victim’s insurance policy, as well as their negotiation strategies.

Prosecutors said Martino’s goal was to maximize compensation for criminals, which he received a portion of. He is the third ransomware negotiator in the past year to face prison for the same scheme.

Assistant Public Prosecutor A. “Angelo Martino’s clients have trusted him to respond to, help thwart, and remediate ransomware threats on behalf of victims,” Thyssen Duva said in the press release. “Instead, he betrayed them and began launching ransomware attacks himself by helping the cybercriminals and harming the victims, their employer, and the cyber incident response industry itself.”

ALPHV/BlackCat operates as a ransomware-as-a-service, meaning the gang develops and maintains the file-locking malware, while contractors acting as affiliates deploy it in cyberattacks and pay a portion of the ransom profits to the developers.

Last year, US prosecutors charged another DigitalMint employee, Kevin Tyler Martin, as well as Ryan Clifford Goldberg, a former incident response director at cybersecurity giant Sygnia, with fraud and aiding a ransomware ring they were ostensibly working to counter during their day jobs.

The authorities at the time mentioned a third person, without naming him, as part of this plan. We now know it was Martino.

Martino pleaded guilty to extortion and faces up to 20 years in prison. Authorities said they had already seized assets worth $10 million from him.

According to the Department of Justice, Martino also admitted to helping Goldberg and Martin spread ALPHV/BlackCat ransomware against multiple victims within the United States for a period of six months in 2023. The three essentially became affiliates of ALPHV/BlackCat during that period, obtaining more than $1.2 million from a single victim, according to prosecutors.

When reached for comment on Tuesday, an unnamed DigitalMint spokesperson told TechCrunch in a statement that the company had no knowledge of Martino’s criminal acts and that it fired the two employees after learning of the accusations against them.

In 2023, an international coalition of law enforcement authorities seized the dark web leak site ALPHV/BlackCat, disrupting its operations. Meanwhile, authorities also released a decryption tool to help more than 500 ALPHV victims recover their systems.