# DigitalMint Ransomware Negotiator Angelo Martino Sentenced to 70 Months for BlackCat/ALPHV Insider Extortion Conspiracy

> Angelo John Martino III, a former ransomware negotiator at incident-response firm DigitalMint, was sentenced to 70 months in federal prison for conspiring with BlackCat/ALPHV ransomware affiliates. While negotiating on behalf of victim organizations, Martino secretly leaked confidential client negotiating positions and cyber-insurance policy limits to the attackers, helping them extort five victims out of a combined $75.3 million.

- **Published:** 2026-07-09T00:00:00Z
- **Last reviewed:** 2026-07-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1155
- **ID:** TL-2026-1155
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** RESOLVED
- **Actor:** BlackCat
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On July 9, 2026, a U.S. District Court in the Southern District of Florida sentenced Angelo John Martino III, 41, of South Florida, to 70 months in prison for conspiracy to obstruct, delay, or affect commerce by extortion, in violation of the Hobbs Act (18 U.S.C. § 1951). Martino was employed by DigitalMint, a third-party ransomware negotiation and incident-response firm, from 2022 until his termination in April 2025 after the scheme surfaced. In his role, Martino was trusted by victim organizations to negotiate ransom payments on their behalf with BlackCat (also known as ALPHV) ransomware affiliates. Instead of acting in his clients' interest, Martino covertly funneled confidential negotiation intelligence -- including victims' internal negotiating positions, walk-away thresholds, and cyber-insurance policy coverage limits -- directly to the BlackCat threat actors he was ostensibly negotiating against. This intelligence allowed the affiliates to calibrate ransom demands to the maximum amount each victim could plausibly pay, rather than guessing blind. Between April and September 2023, this scheme extorted a combined $75.3 million from five victim organizations: a nonprofit ($26.8M), a financial-services company ($25.7M), a hospitality company ($16.5M), a second hospitality/retail victim ($6.1M), and a medical-industry victim ($213,000). An additional five organizations were targeted between April and November 2023 with undisclosed outcomes. Martino received a cut of the illicit proceeds for his participation. The scheme came to light through a parallel DOJ investigation into two other cybersecurity-industry insiders operating the same trusted-insider playbook: Kevin Tyler Martin, a fellow DigitalMint negotiator, and Ryan Clifford Goldberg, an incident-response manager at rival firm Sygnia. Martin and Goldberg, along with an unnamed third co-conspirator, directly attacked and encrypted victim networks using ALPHV/BlackCat ransomware between April and December 2023, targeting a Florida medical company, a Maryland pharmaceutical company, a California doctor's office (whose patient photos were later published on the ALPHV leak site), a Virginia drone manufacturer, and a California engineering firm, netting roughly $1.3 million from the medical company alone and paying BlackCat administrators a 20% affiliate cut for access to the ransomware and leak-site infrastructure. Martin and Goldberg pleaded guilty in December 2024 and were each sentenced to four years in prison in April 2026. Martino was indicted and surrendered in March 2026, released on a $500,000 bond, pleaded guilty in April 2026, and was sentenced July 9, 2026. The DOJ seized roughly $10 million in assets from Martino, including two Florida properties (a Bayfront home worth $1.68 million and a second home worth $396,000), cryptocurrency wallets, multiple vehicles, a food truck, and a 29-foot luxury fishing boat. A restitution hearing is scheduled for September 17, 2026. The case represents a novel insider-threat vector for the incident-response and ransomware-negotiation industry: threat actors co-opting a trusted third-party crisis-response vendor -- normally a defender-side asset -- to leak the exact information (negotiating leverage, insurance limits, walk-away points) that ransomware affiliates need to maximize extortion payouts. BlackCat/ALPHV itself was one of the most prolific ransomware-as-a-service operations, victimizing nearly 70 organizations by leak-site count in a single quarter before being disrupted by an FBI-led operation in December 2023 that seized infrastructure and released a decryption tool credited with saving victims an estimated $99 million; the brand nonetheless continued affiliate activity into 2024 with high-profile hits on MGM Resorts, Fidelity National Financial, and UnitedHealth/Change Healthcare. ALPHV Blackcat affiliates' standard technical playbook -- documented in CISA/FBI/HHS joint advisory AA23-353A -- uses Cobalt Strike and Brute Ratel C4 for command and control, legitimate remote-access tools (AnyDesk, Splashtop) and Mega.nz/Dropbox for exfiltration staging, the Evilginx2 adversary-in-the-middle framework to steal MFA tokens and session cookies, and Metasploit to evade allowlisting controls, before deploying the BlackCat/ALPHV Rust-based locker for double-extortion (encrypt + leak-site publication) impact.

## MITRE ATT&CK

- T1585 Establish Accounts
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1133 External Remote Services
- T1078 Valid Accounts
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1111 Multi-Factor Authentication Interception
- T1003 OS Credential Dumping
- T1087 Account Discovery
- T1046 Network Service Discovery
- T1021 Remote Services
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1071 Application Layer Protocol
- T1219 Remote Access Tools
- T1567 Exfiltration Over Web Service
- T1020 Automated Exfiltration
- T1486 Data Encrypted for Impact
- T1657 Financial Theft
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1560 Archive Collected Data

## Sources

- [DigitalMint ransomware negotiator Angelo Martino sentenced](https://cyberscoop.com/digitalmint-ransomware-negotiator-angelo-martino-sentenced/)
- [Former DigitalMint ransomware negotiator pleads guilty to extortion scheme](https://cyberscoop.com/digitalmint-ransomware-negotiator-angelo-martino-guilty-plea/)
- [Ransomware responders plead guilty to using ALPHV in attacks on US organizations](https://therecord.media/ransomware-responders-guilty-plea-using-alphv-blackcat-us-attacks)
- [Ransomware Insider Betrayal: Guilty Plea In BlackCat Cybercrime Scheme](https://www.forbes.com/sites/steveweisman/2026/06/15/ransomware-insider-betrayal-guilty-plea-in-blackcat-cybercrime-scheme/)
- [American Cybersecurity Professionals Given Jail Terms for BlackCat Ransomware Attacks](https://www.hipaajournal.com/u-s-nationals-indicted-blackcat-ransomware-attacks/)
- [Ransomware Negotiator Pleads Guilty to Aiding BlackCat Attacks in 2023](https://thehackernews.com/2026/04/ransomware-negotiator-pleads-guilty-to.html)
- [US ransomware negotiators get 4 years in prison over BlackCat attacks](https://www.bleepingcomputer.com/news/security/us-ransomware-negotiators-get-4-years-in-prison-over-blackcat-attacks/)
- [Former incident responders plead guilty to ransomware attack spree](https://cyberscoop.com/incident-responders-plead-guilty-ransomware-digitalmint/)
- [2 Cyber Pros Admit to Being BlackCat Ransomware Affiliates](https://www.bankinfosecurity.com/2-cyber-pros-admit-to-being-blackcat-ransomware-affiliates-a-30415)
- [#StopRansomware: ALPHV Blackcat (AA23-353A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a)
- [BlackCat, Software S1068](https://attack.mitre.org/software/S1068/)
- [Ryan Goldberg of Sygnia and Kevin Martin of DigitalMint Get 4 Years for BlackCat Ransomware](https://hannahhowell.com/ryan-goldberg-of-sygnia-and-kevin-martin-of-digitalmint-get-4-years-for-blackcat-ransomware/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1155