Cybersecurity Pros Admit to Moonlighting as BlackCat Ransomware Affiliates

Two cybersecurity professionals have admitted moonlighting as ransomware affiliates, using their technical expertise to extort and profit. Ryan Goldberg, 40, of Georgia, and Kevin Martin, 36, of Texas, pleaded guilty in a federal district court in the Southern District of Florida to a conspiracy to commit extortion linked to the ALPHV/BlackCat ransomware.

The pair, working with a third co-conspirator, operated as affiliates within the BlackCat RaaS model between April and December 2023, identifying targets, breaching networks, and deploying the payload while developers maintained the infrastructure. They agreed to a standard 80/20 split, with affiliates keeping 80% of any ransom. In at least one instance they extorted a victim for about $1.2 million in Bitcoin, then laundered the proceeds.

In December 2023 the DOJ announced a disruption campaign that seized several of their websites and released a decryption tool, saving victims an estimated $99 million in potential ransom payments; Goldberg and Martin are due to be sentenced on 12 March 2026, facing a maximum of 20 years’ imprisonment, according to the Justice Department.