Ransomware negotiator pleads guilty to helping ransomware gang

Angelo Martino, a former ransomware negotiator, has pleaded guilty to helping cybercriminals extort companies in cyberattacks.

US Department of Justice on Monday Announce Pleading guilty. Martino, who worked at cybersecurity firm DigitalMint, admitted to playing both sides of the negotiations in five different incidents. While ostensibly working on behalf of victims, Martino admitted to providing confidential information to ALPHV/BlackCat ransomware operators, providing them with information such as the limits of the victim’s insurance policy, as well as their negotiation strategies.

Prosecutors said Martino’s goal was to maximize compensation for criminals, which he received a portion of. He is the third ransomware negotiator in the past year to face prison for the same scheme.

Assistant Public Prosecutor A. “Angelo Martino’s clients have trusted him to respond to, help thwart, and remediate ransomware threats on behalf of victims,” Thyssen Duva said in the press release. “Instead, he betrayed them and began launching ransomware attacks himself by helping the cybercriminals and harming the victims, their employer, and the cyber incident response industry itself.”

ALPHV/Black Cat It operates as ransomware-as-a-service, meaning the gang develops and maintains the file-locking malware, while contractors acting as affiliates deploy it in cyberattacks and repay a portion of the ransom profits to the developers.

last year, US prosecutors charged Another DigitalMint employee, Kevin Tyler Martin, as well as Ryan Clifford Goldberg, a former incident response director at cybersecurity giant Sygnia, go rogue and aid the ransomware gang they were ostensibly working to counter during their day jobs.

The authorities at the time mentioned a third person, without naming him, as part of this plan. We now know it was Martino.

Martino pleaded guilty to extortion and faces up to 20 years in prison. Authorities said they have already seized $10 million in assets from Martino.

According to the Department of Justice, Martino also admitted to helping Goldberg and Martin spread ALPHV/BlackCat ransomware against multiple victims within the United States for a period of six months in 2023. The three essentially became affiliates of ALPHV/BlackCat during that period, making more than $1.2 million from a single victim, according to prosecutors.

When reached for comment on Tuesday, an unnamed DigitalMint spokesperson told TechCrunch in a statement that the company had no knowledge of Martino’s criminal acts, and that it fired the two employees after learning of the accusations against them.

In 2023, an international coalition of law enforcement authorities He took over the dark web leak site ALPHV/BlackCat, disrupting its operations. Meanwhile, authorities also released a decryption tool to help more than 500 ALPHV victims recover their systems.