A Florida-based ransomware negotiator, Angelo Martino, was sentenced to over five years in prison on Thursday for conspiring with cybercriminals to deploy BlackCat ransomware against US companies while working for a cyber security firm.
Inside the Ransomware Negotiation Double-Cross
The US Department of Justice confirmed the sentence, revealing that federal authorities seized more than $10 million worth of cryptocurrency and physical assets. Prosecutors disclosed that Martino used the illicit proceeds from these extortion schemes to purchase luxury items, including a high-end fishing boat and a food truck.
A Rogue Trio of Cyber Security Professionals
Martino is the third cyber security professional to be jailed in connection with this illicit operation, following the previous convictions of Kevin Martin and Ryan Goldberg. According to federal prosecutors, the trio collaborated throughout 2023 to target American organisations using the notorious BlackCat ransomware. In one specific attack, the rogue specialists successfully extorted approximately $1.2 million from a victim company, splitting the laundered funds equally amongst themselves.
The Dark Side of Cyber Security Incident Response
This landmark investigation exposes a rare and troubling scenario where trusted security professionals actively collaborate with malicious threat actors. While international governments and law enforcement agencies consistently advise organisations against paying ransoms to prevent funding cybercrime, many victim companies still choose to pay in a desperate bid to protect sensitive customer data from being leaked online.
The Rise of Ransomware Insurance and Negotiation
The relentless rise of these extortion tactics has fuelled the growth of a specialised cyber insurance sub-sector in the US and globally. Within this industry, some firms employ dedicated negotiators whose primary role is to communicate with hackers and attempt to lower the demanded ransom fees.
What is the BlackCat Ransomware-as-a-Service?
BlackCat, also operating under the name ALPHV, functions as a ransomware-as-a-service (RaaS) model. This business structure allows independent cybercriminals, known as affiliates, to lease the gang’s sophisticated file-encrypting malware in exchange for a percentage of the extorted profits.
The group’s malware was famously deployed in the devastating cyberattack against US health technology giant Change Healthcare in February 2024. This breach resulted in the theft of highly sensitive medical and billing records belonging to more than 192 million people, although the specific affiliate hackers behind that particular attack remain unidentified.