FBI arrests ransomware clean-up experts—for planting ransomware

According to the FBI, three US-based cybersecurity professionals went rogue over the last two years, planting their own malware into US-based businesses and siphoning illicit profits from ransomware operations.

The piece details Kevin Martin, who worked as a ransomware negotiator for DigitalMint, and Ryan Goldberg of Watkinsville, Georgia, who both allegedly recruited help to carry out attacks, beginning with a May 2023 target, a medical company in Tampa, Florida, where BlackCat ransomware demanded a $10 million ransom and the company eventually paid $1.27 million in crypto.

The operation extended to a pharma company in Maryland, a doctor’s office, an engineering firm in California, and a drone manufacturer in Virginia, with ransom requests ranging from $300,000 to $5 million, yet none others paid. By early 2025, the FBI had ramped up its investigation, leading to searches of Martin’s property in April and Goldberg’s devices in June, followed by Goldberg’s confession and naming Martin as the ringleader.

Goldberg faced extradition journeys via Paris and Mexico City before being arrested, with bail decisions denying him release and potential prison terms estimated at 78 to 97 months if he accepts responsibility. The narrative notes Martin’s $214,000-a-year salary and his eventual bond status at $400,000, while both companies involved stated they were not targets of the inquiry.