Ransomware incident responder gave info to BlackCat cybercriminals during negotiations, DOJ alleges

The Justice Department is accusing an incident responder of conducting cyberattacks and helping ransomware gangs negotiate higher payouts from the same victims he was working for, according to The Record. Angelo Martino surrendered to the U.S. Marshals and bonded out the same day, agreeing to perform no cyber industry work as part of his release.

Prosecutors say Martino worked with two other cybersecurity professionals to launch ransomware attacks on behalf of the now-defunct ALPHV/BlackCat group; Ryan Goldberg and Kevin Martin, who pleaded guilty in December to one count of conspiracy to obstruct commerce by extortion, face up to 20 years in prison with sentencing on 30 April. The trio earned about $1.2 million from an attack on a Florida medical company, though they were unsuccessful against nine other victims.

Goldberg worked for incident response firm Sygnia, while Martin and Martino were ransomware negotiators for DigitalMint, which has cooperated with law enforcement since the problem was alerted in April 2025.