Unnamed victim 2 and Unnamed U.S.-based cyber incident response firm: Florida Ransomware Negotiator Sentenced to 70 Months for Aiding BlackCat Attacks

Former Ransomware Negotiator Sentenced for Colluding with BlackCat Operators

A former ransomware negotiator, Angelo Martino (41, of Land O’Lakes, Florida), has been sentenced to 70 months in federal prison for conspiring with the BlackCat/ALPHV ransomware group to extort victims he was hired to protect. Martino, who worked at a U.S.-based cyber incident response firm, exploited his trusted position by leaking confidential client negotiation details to attackers, enabling them to demand higher ransoms.

Between April and November 2023, Martino collaborated with two other former cybersecurity professionals Kevin Martin (36, Texas) and Ryan Goldberg (41, Georgia) to deploy BlackCat ransomware against additional U.S. victims. The trio successfully extorted $1.2 million in Bitcoin from one victim, splitting and laundering the proceeds. Kevin Martin and Goldberg were each sentenced to 48 months in prison on May 1.

The scheme compromised five ransomware victims, with Martino providing BlackCat operators with insider knowledge of negotiation strategies to maximize ransom payments. Law enforcement has since seized over $10 million in assets, including cryptocurrency, vehicles, a food truck, and a luxury fishing boat. A restitution hearing is set for September 17.

The case is part of Operation Riptide, an FBI initiative targeting cybercrime infrastructure, and follows the DOJ’s December 2023 takedown of BlackCat, which included a decryption tool that saved victims an estimated $99 million. The investigation was led by the FBI’s Miami field office, with support from the U.S. Secret Service.

The sentencing highlights the growing threat of insider collusion in cybercrime, as U.S. cybercrime losses exceeded $20 billion in 2023, a 26% year-over-year increase.

Source: https://cyberpress.org/florida-ransomware-negotiator-sentenced-blackcat-attacks/

Arete cybersecurity rating report: https://www.rankiteo.com/company/arete-advisors-inc-

Chainalysis cybersecurity rating report: https://www.rankiteo.com/company/chainalysis

"id": "ARECHA1783671840",
"linkid": "arete-advisors-inc-, chainalysis",
"type": "Ransomware",
"date": "4/2023",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'customers_affected': '5 ransomware victims',
                        'industry': 'Cybersecurity, Multiple (victims from '
                                    'various industries)',
                        'location': 'United States',
                        'type': 'Cyber incident response firm (client '
                                'victims)'}],
 'attack_vector': 'Insider collusion',
 'data_breach': {'sensitivity_of_data': 'High (negotiation strategies, victim '
                                        'details)',
                 'type_of_data_compromised': 'Confidential negotiation '
                                             'details'},
 'description': 'A former ransomware negotiator, Angelo Martino, was sentenced '
                'to 70 months in federal prison for conspiring with the '
                'BlackCat/ALPHV ransomware group to extort victims he was '
                'hired to protect. Martino leaked confidential client '
                'negotiation details to attackers, enabling them to demand '
                'higher ransoms. The scheme involved two other former '
                'cybersecurity professionals and successfully extorted $1.2 '
                'million in Bitcoin from one victim.',
 'impact': {'financial_loss': '$1.2 million (extorted), $20 billion (U.S. '
                              'cybercrime losses in 2023)'},
 'investigation_status': 'Closed (sentencing completed)',
 'lessons_learned': 'Growing threat of insider collusion in cybercrime; '
                    'importance of vetting cybersecurity professionals; need '
                    'for stricter access controls in incident response firms.',
 'motivation': 'Financial gain',
 'post_incident_analysis': {'corrective_actions': 'Asset seizures ($10M+), '
                                                  'decryption tool '
                                                  'distribution, law '
                                                  'enforcement crackdown on '
                                                  'BlackCat',
                            'root_causes': 'Insider collusion, exploitation of '
                                           'trusted positions, lack of '
                                           'oversight in incident response '
                                           'firms'},
 'ransomware': {'ransom_paid': '$1.2 million (Bitcoin)',
                'ransomware_strain': 'BlackCat/ALPHV'},
 'recommendations': 'Enhance background checks for cybersecurity personnel; '
                    'implement strict access controls and monitoring for '
                    'sensitive client data; establish clear ethical guidelines '
                    'for ransomware negotiators.',
 'references': [{'source': 'U.S. Department of Justice'},
                {'source': 'FBI Operation Riptide'}],
 'regulatory_compliance': {'legal_actions': '70 months (Angelo Martino), 48 '
                                            'months (Kevin Martin, Ryan '
                                            'Goldberg)'},
 'response': {'law_enforcement_notified': 'Yes (FBI, U.S. Secret Service)',
              'remediation_measures': 'DOJ takedown of BlackCat, decryption '
                                      'tool provided to victims'},
 'threat_actor': 'BlackCat/ALPHV ransomware group, Angelo Martino, Kevin '
                 'Martin, Ryan Goldberg',
 'title': 'Former Ransomware Negotiator Sentenced for Colluding with BlackCat '
          'Operators',
 'type': 'Ransomware'}