Ransomware negotiator pleads guilty to helping ransomware gang

Angelo Martino, a former negotiator for a cybersecurity firm, has confessed to aiding cybercriminals in extorting businesses during cyberattacks. This admission came to light on Monday through an announcement from the U.S. Justice Department. Martino, who was previously associated with DigitalMint, revealed that he played a dual role in negotiations for five separate incidents. While appearing to advocate for the victims, he disclosed sensitive information to the operators of the ALPHV/BlackCat ransomware group. This included details about the victims' insurance coverage and their negotiation tactics. Prosecutors allege that Martino's objective was to enhance the criminals' financial gains, from which he profited. This incident marks Martino as the third ransomware negotiator in under a year to face legal consequences for similar activities. Assistant Attorney General A. Tysen Duva criticized Martino's actions, emphasizing that he violated the trust of his clients who relied on him to combat ransomware threats. "Instead, he betrayed them and contributed to the very attacks he was supposed to help mitigate," Duva stated. The ALPHV/BlackCat group operates under a ransomware-as-a-service model, where they develop and maintain the malicious software while affiliates execute the attacks and share a portion of the ransom earnings with the developers. Last year, U.S. authorities charged another DigitalMint staff member, Kevin Tyler Martin, along with Ryan Clifford Goldberg from cybersecurity firm Sygnia, for similarly assisting the ransomware gang they were meant to oppose. Martino has pleaded guilty to extortion charges and could face up to 20 years in prison. Authorities have already confiscated $10 million in assets from him. Additionally, he admitted to collaborating with Goldberg and Martin to deploy ALPHV/BlackCat ransomware against multiple U.S. victims over a six-month period in 2023, which reportedly generated over $1.2 million from a single target. A spokesperson for DigitalMint, who chose to remain anonymous, clarified that the company was unaware of Martino's illegal activities and confirmed that the two implicated employees were terminated upon the discovery of these allegations. In a significant move last year, an international law enforcement coalition disrupted ALPHV/BlackCat's operations by seizing their dark web leak site and releasing a decryption tool that benefited over 500 victims of the ransomware.