Florida ransomware negotiator convicted for helping ransomware gang extort US companies

A Florida resident, Angelo Martino, has been handed a prison sentence exceeding five years for his involvement in a conspiracy that aided hackers in executing ransomware attacks. His role as a negotiator at a U.S. cybersecurity firm was highlighted in the recent announcement from the U.S. Department of Justice. The government revealed that over $10 million in cryptocurrency and various assets were seized as part of the investigation. Martino reportedly purchased items, including a food truck and a luxury fishing boat, using funds obtained from the ransomware operations. He is now the third individual associated with this criminal endeavor to face imprisonment, following cybersecurity experts Kevin Martin and Ryan Goldberg, who were also charged in connection with the scheme. The trio collaborated to unleash the BlackCat ransomware, targeting multiple U.S. companies throughout 2023. In one notable incident, they managed to extort approximately $1.2 million from a business, which they subsequently laundered and divided among themselves. This case sheds light on an unusual intersection of cybersecurity professionals engaging in criminal activities while employed in their field. Despite government advisories discouraging companies from paying ransoms to avoid empowering cybercriminals, many businesses still opt to negotiate payments to safeguard sensitive customer data. The rise of extortion attacks has spurred the growth of a specialized insurance sector in the U.S. designed to address ransomware incidents. Some firms in this domain hire negotiators to help reduce ransom amounts. The BlackCat group, also referred to as ALPHV, operates a ransomware-as-a-service model, enabling independent hackers to rent access to their malware in exchange for a share of the profits from attacks. This group has gained notoriety for a massive data breach in February 2024, where they compromised the medical and billing records of over 192 million individuals affiliated with Change Healthcare, although the hackers responsible for that breach have not been identified.