Do Son 
Image: Unit 42
At a Glance
| Actor | Angelo Martino, 41, former ransomware negotiator; worked with BlackCat/ALPHV affiliates |
|---|---|
| Activity type | Insider betrayal and ransomware extortion |
| Targets / victims | At least five U.S. organizations he was hired to help, plus additional U.S. victims |
| Scale | 70-month sentence; over $10M seized; about $1.2M ransom from one victim |
| Status | Sentenced after guilty plea, Southern District of Florida |
| Source | U.S. Department of Justice |
TL;DR
A former ransomware negotiator has been sentenced to 70 months in federal prison. Angelo Martino fed his clients’ confidential positions to BlackCat ransomware actors. The Justice Department has seized more than $10 million from him.
What Happened
Angelo Martino, 41, of Land O’Lakes, Florida, worked as a ransomware negotiator. Victims hired his firm to help them survive attacks. Instead, he played both sides.
Starting in April 2023, Martino passed confidential details to BlackCat operators. Those details included clients’ negotiating strategies and insurance policy limits. The leaks pushed ransoms higher, and Martino took a cut.
He did not stop there. Martino also joined two former colleagues to deploy BlackCat ransomware themselves. One victim paid about $1.2 million in Bitcoin. The men then split the proceeds and laundered them.
“Angelo Martino sold out the very victims he was hired to represent,” said FBI Cyber Division Assistant Director Brett Leatherman.
Who Is Behind It
Attribution here is firm, not suspected. Martino, the rogue ransomware negotiator, pleaded guilty in April to conspiring to commit extortion. That plea and the sentence establish his role.
Two co-conspirators also pleaded guilty. Kevin Martin of Texas and Ryan Goldberg of Georgia each received 48 months earlier this year. Martino worked at DigitalMint, a firm that helps victims respond to ransomware. DigitalMint is not accused of wrongdoing, and it fired him.
Impact and Scale
The seizures are striking. Officials took $10 million in assets, including digital currency, vehicles, a food truck, and a luxury fishing boat. “The people they hired to help them instead betrayed them to ransomware gangs,” said Assistant Attorney General A. Tysen Duva. A restitution hearing is set for September 17.
The case fits a wider fight. The DOJ disrupted BlackCat in December 2023, and an FBI decryptor saved victims about $99 million. This action is part of Operation Riptide, the FBI’s campaign against cybercrime networks. Last year, Americans reported over $20 billion in cybercrime losses.
What Comes Next
The FBI says it will keep targeting insiders, not just attackers. So vet your incident-response vendors, and verify who handles your negotiations. Report ransomware to the FBI or IC3 without delay.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
