Listen to this Post
Introduction: When Cyber Defenders Become Cybercriminals
Trust is one of the most valuable assets during a ransomware crisis. Organizations facing devastating cyberattacks often rely on incident response firms and professional ransomware negotiators to help them navigate impossible situations. These experts are expected to protect confidential business information, negotiate fair outcomes, and minimize financial damage.
In one of the most shocking insider betrayal cases in recent U.S. cybersecurity history, that trust was deliberately abused. Former ransomware negotiator Angelo Martino secretly worked with the very criminals he was hired to fight. Instead of defending victims, he leaked confidential negotiation strategies, insurance information, and payment capabilities directly to the notorious BlackCat (ALPHV) ransomware gang. His actions helped cybercriminals increase ransom demands while earning him a share of the illegal profits.
The U.S. Department of Justice has now sentenced Martino to 70 months in federal prison, sending a strong warning that insiders who collaborate with cybercriminal organizations will face severe legal consequences.
A Trusted Negotiator Secretly Worked for BlackCat
According to the U.S. Department of Justice, 41-year-old Angelo Martino of Land O’ Lakes, Florida, received a 70-month prison sentence after pleading guilty to conspiring with the BlackCat (ALPHV) ransomware organization.
Martino had been employed as a ransomware negotiator at a U.S.-based incident response company. His official role was to help organizations recover after ransomware attacks, negotiate with attackers, and reduce financial losses.
Instead, prosecutors revealed that he secretly became what they described as a “double agent.”
Rather than protecting clients, Martino quietly shared confidential information with BlackCat operators, allowing them to negotiate from a position of strength.
How the Insider Scheme Operated
Beginning in April 2023, Martino handled negotiations involving at least five ransomware victims.
During these engagements, prosecutors say he secretly transmitted highly sensitive information to BlackCat operators, including:
Insurance policy coverage limits
Maximum ransom budgets
Internal negotiation strategies
Victims’ willingness to pay
Communication plans
This intelligence gave the ransomware gang an enormous advantage.
Instead of guessing how much a victim might afford, attackers already knew the financial limits and adjusted ransom demands accordingly.
Martino reportedly received payments from the ransomware operators in exchange for his insider information.
Victims Paid the Price
Businesses affected by the conspiracy believed they were working with professionals dedicated to helping them recover.
Instead, their confidential recovery plans became valuable intelligence for cybercriminals.
According to prosecutors, several victim companies suffered severe financial damage, with some businesses nearly collapsing because of the increased ransom demands.
Assistant Attorney General A. Tysen Duva stated that many victims described heartbreaking financial losses after discovering that someone hired to protect them had actually helped the attackers.
The Justice Department emphasized that
Collaboration with Other Cybersecurity Professionals
The investigation also uncovered that Martino was not acting alone.
He conspired with fellow cybersecurity professionals Ryan Goldberg and Kevin Martin between April and November 2023.
Despite working within the cybersecurity industry, the trio actively assisted BlackCat ransomware operations against multiple American organizations.
Their technical expertise made ransomware deployments more effective while helping maximize extortion payments.
Millions in Criminal Proceeds
One documented victim reportedly paid approximately $1.2 million in Bitcoin following one of the ransomware attacks.
Court documents indicate that the conspirators divided the cryptocurrency proceeds among themselves before laundering the funds through multiple channels.
The laundering operation was designed to disguise the criminal origin of the money while allowing participants to purchase expensive assets.
Massive Asset Seizures
Federal investigators successfully traced a significant portion of Martino’s illegal earnings.
Authorities seized approximately $10 million worth of assets connected to the conspiracy.
Recovered assets included:
Cryptocurrency holdings
Multiple vehicles
A food truck
A luxury fishing boat
Additional property obtained through illicit profits
A restitution hearing has been scheduled to determine how much Martino must repay to the victims.
Earlier Guilty Pleas Strengthened the Case
The sentencing follows earlier developments involving
In January 2026, Ryan Goldberg and Kevin Martin pleaded guilty to charges connected to BlackCat ransomware operations conducted throughout 2023.
Court filings revealed that the conspirators received roughly 20% of ransom payments collected by BlackCat operators.
Ironically, all three individuals possessed legitimate cybersecurity experience that should have been used to defend organizations rather than exploit them.
Timeline of the Investigation
Federal prosecutors initially announced charges in November against Ryan Clifford Goldberg, Kevin Tyler Martin, and an unidentified Florida accomplice.
The unnamed conspirator remained publicly unidentified until March 2026, when investigators confirmed he was Angelo Martino.
Investigators established that Martino and Kevin Martin worked together at the same incident response company, while Ryan Goldberg worked for a different cybersecurity firm.
This insider access became one of the most dangerous aspects of the conspiracy.
The
The sentencing also highlights the broader U.S.
In December 2023, the FBI successfully disrupted portions of the BlackCat infrastructure through a major international law enforcement operation.
Agents developed a decryption tool capable of helping numerous ransomware victims recover encrypted systems without paying criminals.
According to the Department of Justice, the operation prevented approximately $99 million in ransom payments.
Authorities also seized several websites operated by BlackCat, significantly disrupting the group’s infrastructure and operations.
Why This Case Is Different
Cybercrime investigations usually focus on external hackers.
This case is unusual because one of the attackers was already inside the cybersecurity ecosystem.
Organizations trust negotiators with some of their most sensitive financial information during ransomware incidents. That trust forms the foundation of successful incident response.
Martino exploited that privileged position for personal financial gain.
His conduct demonstrates that insider threats remain one of the greatest risks facing modern cybersecurity operations.
Deep Analysis
This incident reinforces why organizations should implement strict controls over ransomware negotiations and incident response activities.
Example Indicators of Compromise (IOC) Collection
grep -Ri "ALPHV" /var/log/ grep -Ri "BlackCat" /var/log/
Monitor Suspicious PowerShell Activity
Get-WinEvent -LogName Security | Select-String "powershell"
Detect Unexpected Data Transfers
netstat -antp ss -tunap lsof -i
Review Authentication Logs
cat /var/log/auth.log journalctl -u ssh
Hunt for Ransomware Artifacts
find / -iname ".locked" find / -iname ".encrypted" find / -iname ".alphv"
Identify Cryptocurrency Wallet References
grep -Ri "bitcoin" /home grep -Ri "wallet" /var
Verify Endpoint Integrity
sha256sum critical_file rpm -Va debsums -s
Monitor Network Connections
tcpdump -i any wireshark
Recommended Security Controls
Enforce role separation between negotiators and incident response teams.
Apply Zero Trust principles to privileged personnel.
Log every negotiation activity with immutable auditing.
Perform continuous background and behavioral monitoring for privileged employees.
Require dual approval before sharing sensitive financial information.
Encrypt internal communications between incident response teams.
Conduct regular insider threat assessments.
Use Security Information and Event Management (SIEM) platforms to detect unusual employee activity.
Perform independent audits after every ransomware engagement.
Maintain offline backups and tested disaster recovery procedures.
What Undercode Say
The Martino case exposes a cybersecurity problem that technology alone cannot solve. Firewalls, endpoint detection, threat intelligence platforms, and AI-powered security tools are all designed to stop external attackers, yet none of them can fully prevent betrayal by a trusted insider.
The ransomware negotiation industry has expanded rapidly over the past decade as organizations increasingly seek specialists to communicate with cybercriminal groups. These professionals gain access to highly confidential financial data, cyber insurance policies, executive discussions, and business continuity plans. When those individuals become compromised, the damage can exceed what any external hacker could accomplish.
This case will likely trigger greater scrutiny of ransomware negotiation practices across the cybersecurity industry. Companies may begin implementing stronger separation of duties, requiring multiple negotiators for sensitive cases, and introducing independent oversight during every stage of negotiations.
It also raises questions about the cybersecurity supply chain. Businesses often invest heavily in securing networks while assuming their service providers maintain equally rigorous internal controls. This incident demonstrates that vendors themselves can become critical attack surfaces.
Another significant lesson is the financial motivation behind insider crime. Martino allegedly earned substantial profits simply by revealing information that organizations voluntarily entrusted to him. Unlike traditional hacking, he did not need to bypass firewalls or exploit software vulnerabilities. Access had already been granted through his employment.
Law
The BlackCat investigation also reflects increasing international cooperation against ransomware groups. Infrastructure seizures, decryption tools, cryptocurrency tracing, and coordinated prosecutions are making ransomware operations more expensive and risky for attackers.
From a governance perspective, organizations should rethink how much confidential information is shared during negotiations and establish policies that minimize unnecessary exposure. Sensitive financial details should be compartmentalized and disclosed only when absolutely required.
Cyber insurance providers may also respond by tightening requirements for approved negotiators and incident response partners. Expect stricter audits, enhanced compliance obligations, and stronger contractual accountability.
Artificial intelligence could play an important role in detecting insider threats by identifying abnormal communication patterns, unusual document access, and suspicious financial behavior before major damage occurs.
Ultimately, this case is not simply about one corrupt negotiator. It represents a broader reminder that cybersecurity depends just as much on integrity, oversight, and accountability as it does on advanced technology. Organizations that ignore insider risk may find that their greatest vulnerability is not outside the firewall but sitting inside the conference room.
✅ Confirmed: The U.S. Department of Justice announced Angelo Martino’s 70-month prison sentence for conspiring with the BlackCat (ALPHV) ransomware operation and betraying ransomware negotiation clients.
✅ Confirmed: Court records and DOJ statements verify that Martino leaked confidential victim negotiation information, while authorities seized approximately $10 million in assets connected to the conspiracy.
✅ Confirmed: The FBI previously disrupted BlackCat infrastructure in 2023, developed a decryption tool that helped victims avoid an estimated $99 million in ransom payments, and seized multiple websites used by the ransomware operation.
Prediction
(+1) Greater regulation and certification standards for ransomware negotiators are likely to emerge, requiring stronger oversight, mandatory auditing, and stricter ethical controls across the incident response industry.
(-1) Ransomware groups may increasingly attempt to recruit or bribe trusted insiders within cybersecurity firms, insurance companies, and managed security providers, making insider threat detection one of the industry’s highest priorities over the coming years.
▶️ Related Video (82% Match):
https://www.youtube.com/watch?v=2QPom-knljY
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: securityaffairs.com
Extra Source Hub (Possible Sources for article):
https://www.twitter.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
