Loading story…
Former DigitalMint ransomware negotiator Angelo John Martino III was sentenced to 70 months in federal prison for conspiring with BlackCat/ALPHV affiliates and abusing confidential client information to drive up ransomware payments from U.S. victims. Prosecutors said Martino used sensitive details from at least five victim organizations—including negotiating positions, insurance limits, financial status, and planned responses—to help attackers increase pressure and extract larger payments, effectively working both sides of the negotiations. Authorities said the scheme contributed to extortion demands tied to roughly $75.3 million in victim losses.
Martino also admitted conspiring with former DigitalMint negotiator Kevin Tyler Martin and former Sygnia incident response manager Ryan Clifford Goldberg to deploy BlackCat ransomware against five additional U.S. companies, including a medical firm that paid nearly $1.3 million in Bitcoin. The case was investigated by the FBI Miami Field Office and the U.S. Secret Service as part of Operation Riptide, and authorities seized millions in assets linked to Martino, with reports citing between $7 million and $10 million. The sentencing highlights the insider risk facing ransomware victims that rely on outside negotiators and incident response firms during extortion events.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
The Justice Department said a restitution hearing in the Angelo Martino case is scheduled for September 17, 2026, following his sentencing for conspiring with BlackCat affiliates. The hearing will address restitution related to the ransomware conspiracy.
During 2023, Angelo Martino secretly shared confidential DigitalMint client negotiation details, including cyber-insurance limits and internal positions, with BlackCat/ALPHV affiliates. Prosecutors said the leaks helped the ransomware gang demand and obtain higher ransom payments from affected clients.
The reference states that Martino's co-conspirators, former DigitalMint negotiator Kevin Martin and former Sygnia incident response manager Ryan Goldberg, were each sentenced to 48 months in prison for their roles in the BlackCat-linked scheme.
Authorities seized millions of dollars in assets connected to Martino as part of the investigation into the BlackCat-related conspiracy. One report says about $10 million was seized, while another says more than $7 million was seized.
Martino also admitted conspiring with former DigitalMint negotiator Kevin Tyler Martin and former Sygnia incident response manager Ryan Clifford Goldberg to deploy BlackCat ransomware against five additional U.S. companies. One medical company paid nearly $1.3 million, and another report says about $1 million in Bitcoin was extorted from one victim.
Prosecutors said Angelo John Martino III abused confidential information from victim organizations while working as a ransomware negotiator, sharing details such as negotiating positions, insurance limits, and planned ransom responses with BlackCat/ALPHV affiliates to help extract larger payments. The conduct affected multiple U.S. victims and contributed to tens of millions of dollars in extortion demands and payments.
Former ransomware negotiator Angelo Martino was sentenced to 70 months in federal prison for conspiring with BlackCat/ALPHV affiliates and betraying clients by misusing confidential victim information. The FBI Miami Field Office and U.S. Secret Service investigated the case, including under Operation Riptide.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
17 references tracked. Mallory keeps watching after this page renders.
malwarebytes.com
Open sourcexakep.ru
Open sourcehelpnetsecurity.com
Open sourcecysecurity.news
Open sourcebleepingcomputer.com
Open sourcejustice.gov
Open sourcebitdefender.com
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Former DigitalMint ransomware negotiator Angelo Martino pleaded guilty to conspiring with **ALPHV/BlackCat** operators and U.S.-based accomplices to attack and extort American organizations while simultaneously serving in a trusted incident-response role. Prosecutors said Martino used insider access to share confidential victim information — including negotiation positions, strategies, and insurance policy limits — with BlackCat actors, helping drive up ransom demands. He was previously charged with conspiracy to interfere with interstate commerce by extortion after surrendering to U.S. Marshals, and he now faces up to 20 years in prison. Court filings allege Martino worked with former DigitalMint negotiator Kevin Tyler Martin and former Sygnia incident response manager Ryan Goldberg in at least 10 attacks, including cases where five victims hired DigitalMint and were assigned Martino as their negotiator. Authorities said the group acted as BlackCat affiliates, paid the gang a 20% share for use of its ransomware and extortion portal, and extracted more than **$75.25 million** across multiple incidents, including payments exceeding **$25 million** and one Florida medical-sector extortion that yielded about **$1.2 million** in Bitcoin. Law enforcement has seized roughly **$10 million** or more in Martino’s assets, while DigitalMint said it was unaware of the scheme, fired the implicated employees, cooperated with investigators, and added stronger oversight, auditing, and logging controls.
Jun 29, 2026
U.S. prosecutors announced two significant ransomware case outcomes: Armenian national **Karen Serobovich Vardanyan** pleaded guilty to conspiracy and computer fraud for helping compromise U.S. organizations and deploy **Ryuk** ransomware, while Florida resident **Angelo Martino** was sentenced to **70 months** for assisting the **BlackCat/ALPHV** gang. Court records say Vardanyan provided initial access to victim networks between November 2019 and April 2020, with victims including a Michigan company, a technology firm in Wilsonville, Oregon, and a Texas school. Prosecutors linked Vardanyan and his co-conspirators to roughly **1,610 bitcoin** in ransom payments, valued at about **$15 million** at the time. Vardanyan was arrested in Kyiv in April 2025, extradited to the United States in 2025, and now faces up to **15 years in prison**, fines of **$250,000 per charge**, and more than **$1.1 million** in restitution; sentencing is scheduled for September 2026. In the separate BlackCat/ALPHV case, Martino was convicted for abusing his position as a ransomware negotiator to share confidential victim negotiation information with attackers, and his co-conspirators **Ryan Goldberg** and **Kevin Martin** had already received four-year prison terms. The cases underscore continued U.S. efforts to disrupt both ransomware operators and the support networks that enable extortion campaigns.
Jul 12, 2026
Three former employees of cybersecurity firms DigitalMint and Sygnia have been indicted for orchestrating a series of BlackCat (ALPHV) ransomware attacks against five U.S. companies between May and November 2023. The accused, including Kevin Tyler Martin and Ryan Clifford Goldberg, allegedly abused their positions as incident response professionals to gain unauthorized access to victim networks, deploy ransomware, steal sensitive data, and demand cryptocurrency ransoms ranging from $300,000 to $10 million. The Department of Justice and FBI state that the group operated as BlackCat affiliates, with at least one successful extortion resulting in a $1.27 million payment from a Tampa medical device manufacturer after its servers were encrypted. The indictment details additional targets, including a Maryland pharmaceutical company, a California doctor's office, a California engineering firm, and a Virginia drone manufacturer, though it is unclear if further ransom payments were made. DigitalMint and Sygnia have both denied organizational involvement, terminated the implicated employees, and are cooperating with law enforcement. The case highlights the risk of insider threats within cybersecurity firms and the sophisticated tactics used by ransomware operators to exploit trusted access for criminal gain.
Jun 29, 2026