Ex-ransomware negotiator gets 70 months for betraying clients to hackers

A former ransomware negotiator was sentenced to 70 months in federal prison for conspiring with BlackCat, also known as ALPHV, ransomware operators to extort multiple victims, according to the Justice Department.

Angelo Martino, 41, of Land O’ Lakes, Florida, worked as a ransomware negotiator for a U.S.-based cyber incident response company when he began conspiring with operators of the BlackCat ransomware variant in April 2023, prosecutors said. According to court documents, Martino was paid by BlackCat attackers to provide confidential information about his employer’s clients’ negotiating positions and strategies, helping the hackers maximize ransom payments from five victims.

“Angelo Martino’s victims shared heartbreaking accounts of how their businesses were nearly destroyed, while the people they hired to help them instead betrayed them to ransomware gangs,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division.

U.S. Attorney Jason A. Reding Quiñones for the Southern District of Florida said Martino “fed their confidential negotiating positions to ransomware criminals” and helped squeeze victims for more money. FBI Cyber Division Assistant Director Brett Leatherman said the sentence demonstrates the bureau will pursue “the insiders who enable” ransomware attacks, not just the hackers themselves.

Prosecutors said Martino also conspired with former cybersecurity professionals Kevin Martin, 36, of Texas, and Ryan Goldberg, 41, of Georgia, to deploy BlackCat ransomware against additional victims across the United States between April and November 2023. The scheme yielded approximately $1.2 million in Bitcoin from one victim, which the three men split and laundered through various means, according to court documents. Martin and Goldberg were each sentenced to 48 months in prison on May 1 by Judge K. Michael Moore in the Southern District of Florida.

Martino pleaded guilty April 14 to one count of conspiring to interfere with interstate commerce through extortion. Law enforcement has seized $10 million in assets tied to Martino, including digital currency, vehicles, a food truck and a luxury fishing boat obtained through the scheme, officials said. A hearing to determine restitution is scheduled for Sept. 17.

The sentencing follows the Justice Department’s December 2023 disruption of BlackCat, during which the FBI developed a decryption tool that officials said helped victims restore their systems and avoid approximately $99 million in ransom payments. The operation also resulted in the seizure of several websites operated by the ransomware group.

The FBI’s Miami field office led the investigation with assistance from the U.S. Secret Service. The prosecution is part of Operation Riptide, the FBI’s ongoing campaign targeting the criminal actors, infrastructure and financial networks behind cybercrime, cyber-enabled crime and fraud. According to the FBI, Americans reported more than $20 billion in cybercrime losses last year, a 26% increase from the previous year.