The third of three former ransomware negotiators accused of assisting the ALPHV/BlackCat ransomware gang in extorting US businesses has pleaded guilty, months after his two co-workers did the same.
Angelo Martino, 41, was a former ransomware negotiator at what is only referred to in court documents as Company-1 – Chicago-based incident response company DigitalMint.
The Florida man pleaded guilty to his role in helping the once-dominant ransomware outfit extort five US companies, all of which were supposedly paying DigitalMint to deploy its experts to help minimize the damage caused by the cyberattacks.
In reality, Martino was feeding confidential information about the victims to help ALPHV/BlackCat maximize their ransom payment.
The court’s list of allegations [PDF] claimed Martino financially benefited from passing on information including the victims’ cyber insurance policy limits and details about how the negotiations were being perceived internally.
A spokesperson at DigitalMint told The Register: “The actions of Martino and his co-conspirators, unknown to the company, were in clear violation of the company’s values, ethical standards, and the law. The government has now made clear that DigitalMint was also an unknowing victim of these crimes.
“Upon learning of the allegations from the Department of Justice, DigitalMint immediately terminated the employees involved and fully cooperated with federal authorities throughout the investigation.”
Recently unsealed files detailed each of the five companies’ ransom payments for the first time.
One, a victim from the hospitality industry, paid a ransom using cryptocurrency worth $16,484,000 at the time. Another, a nonprofit, paid a ransom worth nearly $26.8 million, and a financial services company paid a sum worth at the time north of $25.6 million.
Additionally, Martino helped secure ransom payments worth at the time $6.1 million from a retail company and $213,000 from a medical company.
Separately, he also admitted to joining his co-workers, Ryan Clifford Goldberg and Kevin Tyler Martin, in deploying the ALPHV/BlackCat ransomware payload against “multiple victims” between April 2023 and November 2023.
According to the earlier October indictment [PDF], in which Martino was not named at the time, across the five ransomware attacks the trio carried out themselves, they demanded more than $16 million in ransom payments.
The details of only one payment were included in the indictment, but that single payment from a medical device company landed the trio a $1.274 million payday.
Officials claimed Martino, Goldberg, and Martin had split the ransom three ways and laundered their illicit gains.
Law enforcement agencies have so far seized assets worth around $10 million from Martino alone, including a food truck, digital currency, a 1999 Nissan Skyline, a 2024 Polar RZR-24 all-terrain vehicle, and a luxury fishing boat he bought using the proceeds of crime.
Court documents also show that two of Martino’s Florida properties are also subject to forfeiture.
“Ransomware victims turned to this defendant for help, and he sold them out from the inside,” said Jason A. Reding Quiñones, US attorney for the Southern District of Florida.
“As he admitted in court, he abused his position at a cyber incident response company to feed confidential information to BlackCat actors, helping them maximize ransom payments from American victims. He then went further, joining the conspiracy himself to deploy ransomware and profit from extortion.
“This guilty plea makes clear that if you weaponize insider access and cybersecurity expertise against victims in South Florida or anywhere in this country, you will be prosecuted. And as the seizure of more than $10 million in assets shows, you will not get to keep the proceeds of your crime.”
While Martino’s sentencing hearing is set for July, the fates of Goldberg and Martin, who both pleaded guilty in December, will be decided later this month, on April 30.
All three face maximum prison sentences of 20 years. ®