California engineering firm, California doctor’s office and Florida medical device firm: Ransomware negotiator jailed for 70 months after he just helped infect victims with malware

Ransomware Negotiator Sentenced to Nearly Six Years for Aiding BlackCat Attackers

A U.S. court has sentenced 41-year-old Angelo Martino, a former ransomware negotiator, to 70 months in prison for secretly collaborating with the BlackCat (ALPHV) ransomware group. Martino, based in Land O’Lakes, Florida, was convicted of sharing insider information with attackers to inflate ransom demands, betraying his clients’ trust.

As part of his sentence, Martino must forfeit all cryptocurrency proceeds, along with assets purchased with the illicit funds including houses, cars, and boats. Additionally, he will be required to pay 10% of his future salary post-release.

Martino is the third negotiator exposed in the scheme, following Ryan Clifford Goldberg (Georgia) and Kevin Tyler Martin (Texas), who each received four-year sentences in April 2026 for similar offenses. The trio exploited their positions to infect victims with ransomware and leak sensitive data to BlackCat affiliates, maximizing payouts.

Their victims included five companies: a Florida medical device firm (demanded $10M, paid ~$1.2M), a Maryland pharmaceutical company, a California doctor’s office, a California engineering firm, and a Virginia drone manufacturer. Despite facing 10–20 years in prison, the defendants received reduced sentences after cooperating with authorities though Martino’s request for a 24-month term was denied.

The case highlights the growing threat of insider collusion in ransomware operations, where trusted intermediaries exploit victims for personal gain.

Source: https://www.techradar.com/pro/security/ransomware-negotiator-hired-to-represent-victims-was-working-for-the-attackers

California Rural Legal Assistance, Inc. cybersecurity rating report: https://www.rankiteo.com/company/california-rural-legal-assistance-inc.

Florida Risk Partners cybersecurity rating report: https://www.rankiteo.com/company/florida-risk-partners

"id": "CALFLO1783967322",
"linkid": "california-rural-legal-assistance-inc., florida-risk-partners",
"type": "Ransomware",
"date": "11/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Medical Devices',
                        'location': 'Florida, USA',
                        'name': 'Florida medical device firm',
                        'type': 'Company'},
                       {'industry': 'Pharmaceutical',
                        'location': 'Maryland, USA',
                        'name': 'Maryland pharmaceutical company',
                        'type': 'Company'},
                       {'industry': 'Healthcare',
                        'location': 'California, USA',
                        'name': 'California doctor’s office',
                        'type': 'Medical Practice'},
                       {'industry': 'Engineering',
                        'location': 'California, USA',
                        'name': 'California engineering firm',
                        'type': 'Company'},
                       {'industry': 'Defense/Aerospace',
                        'location': 'Virginia, USA',
                        'name': 'Virginia drone manufacturer',
                        'type': 'Company'}],
 'attack_vector': 'Insider collusion (ransomware negotiator)',
 'data_breach': {'data_exfiltration': 'Yes',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': 'Sensitive data'},
 'description': 'A U.S. court has sentenced 41-year-old Angelo Martino, a '
                'former ransomware negotiator, to 70 months in prison for '
                'secretly collaborating with the BlackCat (ALPHV) ransomware '
                'group. Martino shared insider information with attackers to '
                'inflate ransom demands, betraying his clients’ trust. He must '
                'forfeit cryptocurrency proceeds and assets, and pay 10% of '
                'his future salary post-release. The case involved three '
                'negotiators who exploited their positions to infect victims '
                'with ransomware and leak sensitive data to BlackCat '
                'affiliates.',
 'impact': {'data_compromised': 'Sensitive data leaked',
            'financial_loss': '~$1.2M paid by one victim (demanded $10M)'},
 'investigation_status': 'Closed (sentencing completed)',
 'lessons_learned': 'Growing threat of insider collusion in ransomware '
                    'operations, where trusted intermediaries exploit victims '
                    'for personal gain.',
 'motivation': 'Financial gain',
 'post_incident_analysis': {'corrective_actions': 'Cooperation with '
                                                  'authorities, asset '
                                                  'forfeiture, and sentencing',
                            'root_causes': 'Insider collusion by ransomware '
                                           'negotiators'},
 'ransomware': {'data_exfiltration': 'Yes',
                'ransom_demanded': '$10M (one victim)',
                'ransom_paid': '~$1.2M (one victim)',
                'ransomware_strain': 'BlackCat (ALPHV)'},
 'references': [{'source': 'U.S. Court Sentencing'}],
 'regulatory_compliance': {'legal_actions': 'Criminal charges and sentencing'},
 'response': {'law_enforcement_notified': 'Yes (U.S. authorities)'},
 'threat_actor': 'BlackCat (ALPHV) ransomware group',
 'title': 'Ransomware Negotiator Sentenced for Aiding BlackCat Attackers',
 'type': 'Ransomware'}