Yet another ex-ransomware negotiator admits turning rogue after payoff from crimelords
(2026/04/21)
- Reference: 1776780927
- News link: https://www.theregister.co.uk/2026/04/21/yet_another_ex_ransomware_negotiator_pleads/
- Source link:
The third of three former ransomware negotiators accused of assisting the ALPHV/BlackCat ransomware gang in extorting US businesses has pleaded guilty, months after his two co-workers did the same.
Angelo Martino, 41, was a former ransomware negotiator at what is only referred to in court documents as Company-1 - Chicago-based incident response company DigitalMint.
The Florida man pleaded guilty to his role in helping the once-dominant ransomware outfit extort five US companies, all of which were supposedly paying DigitalMint to deploy its experts to help minimize the damage caused by the cyberattacks.
[1]
In reality, Martino was feeding confidential information about the victims to help [2]ALPHV/BlackCat maximize their ransom payment.
[3]
[4]
The court's [5]list of allegations [PDF] claimed Martino financially benefited from passing on information including the victims' cyber insurance policy limits and details about how the negotiations were being perceived internally.
A spokesperson at DigitalMint told The Register : "The actions of Martino and his co-conspirators, unknown to the company, were in clear violation of the company’s values, ethical standards, and the law. The government has now made clear that DigitalMint was also an unknowing victim of these crimes.
[6]
"Upon learning of the allegations from the Department of Justice, DigitalMint immediately terminated the employees involved and fully cooperated with federal authorities throughout the investigation."
Recently unsealed files detailed each of the five companies' ransom payments for the first time.
One, a victim from the hospitality industry, paid a ransom using cryptocurrency worth $16,484,000 at the time. Another, a nonprofit, paid a ransom worth nearly $26.8 million, and a financial services company paid a sum worth at the time north of $25.6 million.
[7]
Additionally, Martino helped secure ransom payments worth at the time $6.1 million from a retail company and $213,000 from a medical company.
Separately, he also admitted to joining his co-workers, Ryan Clifford Goldberg and Kevin Tyler Martin, in [8]deploying the ALPHV/BlackCat ransomware payload against "multiple victims" between April 2023 and November 2023.
According to the earlier [9]October indictment [PDF], in which Martino was not named at the time, across the five ransomware attacks the trio carried out themselves, they demanded more than $16 million in ransom payments.
The details of only one payment were included in the indictment, but that single payment from a medical device company landed the trio a $1.274 million payday.
Officials claimed Martino, Goldberg, and Martin had split the ransom three ways and laundered their illicit gains.
Law enforcement agencies have so far seized assets worth around $10 million from Martino alone, including a food truck, digital currency, a 1999 Nissan Skyline, a 2024 Polar RZR-24 all-terrain vehicle, and a luxury fishing boat he bought using the proceeds of crime.
Court documents also show that two of Martino's Florida properties are also subject to forfeiture.
"Ransomware victims turned to this defendant for help, and he sold them out from the inside," said Jason A. Reding Quiñones, US attorney for the Southern District of Florida.
"As he admitted in court, he abused his position at a cyber incident response company to feed confidential information to BlackCat actors, helping them maximize ransom payments from American victims. He then went further, joining the conspiracy himself to deploy ransomware and profit from extortion.
[10]Adaptavist Group breach spawns imposter emails as ransomware crew claims mega-haul
[11]Scot becomes second Scattered Spider-linked crook to plead guilty in US
[12]Zombie Microsoft bugs rise from the dead, pave way for crims and ransomware scum
[13]Automotive data biz Autovista blames ransomware for service disruption
"This guilty plea makes clear that if you weaponize insider access and cybersecurity expertise against victims in South Florida or anywhere in this country, you will be prosecuted. And as the seizure of more than $10 million in assets shows, you will not get to keep the proceeds of your crime."
While Martino's sentencing hearing is set for July, the fates of Goldberg and Martin, who both [14]pleaded guilty in December , will be decided later this month, on April 30.
All three face maximum prison sentences of 20 years. ®
Get our [15]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aeefIkydiLAHpkVWBO-P9QAAAI0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.theregister.com/2024/02/26/alphv_healthcare_unitedhealth/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aeefIkydiLAHpkVWBO-P9QAAAI0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aeefIkydiLAHpkVWBO-P9QAAAI0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://regmedia.co.uk/2026/04/21/angelo_martino_allegations_courtlistener.pdf
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aeefIkydiLAHpkVWBO-P9QAAAI0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aeefIkydiLAHpkVWBO-P9QAAAI0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2025/11/03/rogue_ransomware_negotiators/
[9] https://regmedia.co.uk/2025/11/03/ryancliffordgoldberg_kevintylermartin_indictment.pdf
[10] https://www.theregister.com/2026/04/21/adaptavist_group_breach_spawns_impostor/
[11] https://www.theregister.com/2026/04/20/scattered_spider_linked_scot_plead_guilty/
[12] https://www.theregister.com/2026/04/13/ransomware_gang_other_crims_attacking/
[13] https://www.theregister.com/2026/04/15/automotive_data_biz_autovista_ransomware/
[14] https://www.theregister.com/2025/12/31/alphv_ransomware_affiliates_plead_guilty/
[15] https://whitepapers.theregister.com/
Angelo Martino, 41, was a former ransomware negotiator at what is only referred to in court documents as Company-1 - Chicago-based incident response company DigitalMint.
The Florida man pleaded guilty to his role in helping the once-dominant ransomware outfit extort five US companies, all of which were supposedly paying DigitalMint to deploy its experts to help minimize the damage caused by the cyberattacks.
[1]
In reality, Martino was feeding confidential information about the victims to help [2]ALPHV/BlackCat maximize their ransom payment.
[3]
[4]
The court's [5]list of allegations [PDF] claimed Martino financially benefited from passing on information including the victims' cyber insurance policy limits and details about how the negotiations were being perceived internally.
A spokesperson at DigitalMint told The Register : "The actions of Martino and his co-conspirators, unknown to the company, were in clear violation of the company’s values, ethical standards, and the law. The government has now made clear that DigitalMint was also an unknowing victim of these crimes.
[6]
"Upon learning of the allegations from the Department of Justice, DigitalMint immediately terminated the employees involved and fully cooperated with federal authorities throughout the investigation."
Recently unsealed files detailed each of the five companies' ransom payments for the first time.
One, a victim from the hospitality industry, paid a ransom using cryptocurrency worth $16,484,000 at the time. Another, a nonprofit, paid a ransom worth nearly $26.8 million, and a financial services company paid a sum worth at the time north of $25.6 million.
[7]
Additionally, Martino helped secure ransom payments worth at the time $6.1 million from a retail company and $213,000 from a medical company.
Separately, he also admitted to joining his co-workers, Ryan Clifford Goldberg and Kevin Tyler Martin, in [8]deploying the ALPHV/BlackCat ransomware payload against "multiple victims" between April 2023 and November 2023.
According to the earlier [9]October indictment [PDF], in which Martino was not named at the time, across the five ransomware attacks the trio carried out themselves, they demanded more than $16 million in ransom payments.
The details of only one payment were included in the indictment, but that single payment from a medical device company landed the trio a $1.274 million payday.
Officials claimed Martino, Goldberg, and Martin had split the ransom three ways and laundered their illicit gains.
Law enforcement agencies have so far seized assets worth around $10 million from Martino alone, including a food truck, digital currency, a 1999 Nissan Skyline, a 2024 Polar RZR-24 all-terrain vehicle, and a luxury fishing boat he bought using the proceeds of crime.
Court documents also show that two of Martino's Florida properties are also subject to forfeiture.
"Ransomware victims turned to this defendant for help, and he sold them out from the inside," said Jason A. Reding Quiñones, US attorney for the Southern District of Florida.
"As he admitted in court, he abused his position at a cyber incident response company to feed confidential information to BlackCat actors, helping them maximize ransom payments from American victims. He then went further, joining the conspiracy himself to deploy ransomware and profit from extortion.
[10]Adaptavist Group breach spawns imposter emails as ransomware crew claims mega-haul
[11]Scot becomes second Scattered Spider-linked crook to plead guilty in US
[12]Zombie Microsoft bugs rise from the dead, pave way for crims and ransomware scum
[13]Automotive data biz Autovista blames ransomware for service disruption
"This guilty plea makes clear that if you weaponize insider access and cybersecurity expertise against victims in South Florida or anywhere in this country, you will be prosecuted. And as the seizure of more than $10 million in assets shows, you will not get to keep the proceeds of your crime."
While Martino's sentencing hearing is set for July, the fates of Goldberg and Martin, who both [14]pleaded guilty in December , will be decided later this month, on April 30.
All three face maximum prison sentences of 20 years. ®
Get our [15]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aeefIkydiLAHpkVWBO-P9QAAAI0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.theregister.com/2024/02/26/alphv_healthcare_unitedhealth/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aeefIkydiLAHpkVWBO-P9QAAAI0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aeefIkydiLAHpkVWBO-P9QAAAI0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://regmedia.co.uk/2026/04/21/angelo_martino_allegations_courtlistener.pdf
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aeefIkydiLAHpkVWBO-P9QAAAI0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aeefIkydiLAHpkVWBO-P9QAAAI0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2025/11/03/rogue_ransomware_negotiators/
[9] https://regmedia.co.uk/2025/11/03/ryancliffordgoldberg_kevintylermartin_indictment.pdf
[10] https://www.theregister.com/2026/04/21/adaptavist_group_breach_spawns_impostor/
[11] https://www.theregister.com/2026/04/20/scattered_spider_linked_scot_plead_guilty/
[12] https://www.theregister.com/2026/04/13/ransomware_gang_other_crims_attacking/
[13] https://www.theregister.com/2026/04/15/automotive_data_biz_autovista_ransomware/
[14] https://www.theregister.com/2025/12/31/alphv_ransomware_affiliates_plead_guilty/
[15] https://whitepapers.theregister.com/
Sok Puppette
Yet another reason that making any payment whatsoever to any ransomware operator should be illegal, with serious criminal penalties.
20 years seems way too light
retiredFool
I've always felt when a perp pulls off a stunt that is in the millions, basically a lifetime of income for most, the perp committed the equivalent of murder and should be sentenced appropriately.
Re: 20 years seems way too light
Anonymous Coward
.. but enough about Trump..
Man in the Middle
We have all had a disaster and had to call in 'a Man'* to deal with it. I have personal experience of calling in a 'plumber' to get my toilet to flush properly, which it did for a week or so. Then he had to come back and fix it again. Then a year later it failed and I found out: A, that I could fix it myself and B, that the aforementioned 'plumber' had merely stuck the torn plastic sheet that is used in the siphon back together with sticky tape (for which I had been charged £217.00). But even He did not actively sabotage my toilet.
This is a 'man in the middle attack' done so much worse. One should not judge without all the facts, I mean, maybe he needs several properties in Florida, but I hope he gets a serious sentence. When you call someone in to do some serious work, watch them like a hawk and get them to explain exactly what they are doing, or you may regret it.
*Women are also available and just as competent in my experience.