# Former DigitalMint Ransomware Negotiator Angelo Martino Sentenced to 70 Months for BlackCat/ALPHV Extortion Scheme

> Angelo John Martino III, a former DigitalMint ransomware negotiator, was sentenced to 70 months in federal prison for colluding with BlackCat (ALPHV) ransomware affiliates while representing victim companies during negotiations, sharing confidential insurance-policy limits and negotiating positions to maximize extortion payouts across five U.S. organizations totaling $75.3 million. Co-conspirators Kevin Tyler Martin (also a DigitalMint negotiator) and Ryan Clifford Goldberg (a former Sygnia incident-response manager) were each sentenced to 4 years in April 2026 for a related, separate spree of BlackCat/ALPHV attacks against five additional companies.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1166
- **ID:** TL-2026-1166
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** RESOLVED
- **Actor:** BlackCat
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Between April 2023 and November 2023, Angelo John Martino III (41, South Florida), while employed by incident-response and ransomware-negotiation firm DigitalMint, abused his trusted position as the assigned negotiator for at least five U.S. victim organizations to secretly collude with BlackCat/ALPHV ransomware affiliates. Martino shared confidential client information obtained through his negotiator role — including cyber-insurance policy limits and the victims' authorized negotiating ceilings — with ransomware operators via backchannels, enabling the affiliates (and Martino himself, who received a cut of the proceeds) to extract the maximum possible ransom payment from each victim. In effect, Martino negotiated against himself: representing the victim on one side of the table while feeding the attacker actionable intelligence on the other. He also provided affiliate account access and, per prosecutors, instructed accomplices to deny settlement offers and withhold payment ceilings from victims to inflate demands. The five victims he colluded against paid a combined $75.3 million, with individual payments including $26.79 million (a nonprofit), $25.66 million (a financial-services firm), $16.5 million (a hospitality company), $6.1 million, and $213,000. A separate but related conspiracy tied to the same case involved Martino, Kevin Tyler Martin (a fellow DigitalMint negotiator), and Ryan Clifford Goldberg (a former manager of incident response at Sygnia), who together attempted to deploy BlackCat/ALPHV ransomware directly against five additional U.S. companies (a Florida medical company, a Maryland pharmaceutical company, a California doctor's office, a Virginia drone manufacturer, and a California engineering company) between April and December 2023. Only one of those five attacks succeeded — the Florida medical company paid roughly $1.2-1.3 million — while patient photos stolen from the California doctor's office were published on BlackCat's leak site as pressure despite no ransom being paid. In all schemes, 20% of ransom proceeds were remitted to BlackCat/ALPHV RaaS administrators per the group's affiliate revenue-share model. Martino pleaded guilty in April 2026 to conspiracy to obstruct commerce by extortion and was sentenced July 9, 2026 to 70 months in prison; Martin and Goldberg pleaded guilty in December 2025 and were sentenced in April 2025/2026 to 4 years each. Authorities seized roughly $10 million in assets tied to Martino, including a $1.68 million home, a $396,000 property, a food truck, a 29-foot luxury fishing boat, vehicles, and cryptocurrency; two Florida properties remain subject to forfeiture, with a restitution hearing scheduled for September 17, 2026. This is a legal/enforcement outcome rather than an active technical threat — no new CVE, malware sample, or network IOC was disclosed in the reporting — but it is directly relevant to SOC/threat-intel tracking of BlackCat/ALPHV affiliate TTPs (per CISA #StopRansomware Advisory AA23-353A) and to insider-collusion risk within incident-response and ransomware-negotiation workflows, which sit inside the trusted response chain of victim organizations.

## MITRE ATT&CK

- T1598 Phishing for Information
- T1586 Compromise Accounts
- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1106 Native API
- T1059.003 Windows Command Shell
- T1548.002 Bypass User Account Control
- T1134 Access Token Manipulation
- T1055 Process Injection
- T1112 Modify Registry
- T1222.001 Windows Permissions
- T1685.005 Clear Windows Event Logs
- T1003 OS Credential Dumping
- T1003.001 LSASS Memory
- T1087 Account Discovery
- T1087.002 Domain Account
- T1069.001 Local Groups
- T1069.002 Domain Groups
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1016 System Network Configuration Discovery
- T1049 System Network Connections Discovery
- T1018 Remote System Discovery
- T1135 Network Share Discovery
- T1047 Windows Management Instrumentation
- T1680 Local Storage Discovery
- T1021.001 Remote Desktop Protocol
- T1570 Lateral Tool Transfer
- T1105 Ingress Tool Transfer
- T1197 BITS Jobs
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1561.001 Disk Content Wipe
- T1491.001 Internal Defacement

## Sources

- [US ransomware negotiator gets 4 years in prison for BlackCat attacks](https://www.bleepingcomputer.com/news/security/us-ransomware-negotiator-gets-4-years-in-prison-for-blackcat-attacks/)
- [Former DigitalMint ransomware negotiator who duped clients sentenced to 70 months in jail](https://cyberscoop.com/digitalmint-ransomware-negotiator-angelo-martino-sentenced/)
- [Florida Man Working as a Ransomware Negotiator Pleads Guilty to Conspiracy to Deploy Ransomware and Extort U.S. Victims](https://www.justice.gov/opa/pr/florida-man-working-ransomware-negotiator-pleads-guilty-conspiracy-deploy-ransomware-and)
- [Former DigitalMint ransomware negotiator pleads guilty to extortion scheme](https://cyberscoop.com/digitalmint-ransomware-negotiator-angelo-martino-guilty-plea/)
- [Feds say another DigitalMint negotiator ran ransomware attacks and helped extort $75 million](https://cyberscoop.com/digitalmint-ransomware-negotiator-arrest-angelo-martino-extortion/)
- [Chicago cybersecurity firm employee brokered $75M in ransom after orchestrating hacks, feds say](https://chicago.suntimes.com/the-watchdogs/2026/03/13/chicago-digitalmint-hack-ransomware-crime-angelo-martino-marc-grens)
- [Former incident responders plead guilty to ransomware attack spree](https://cyberscoop.com/incident-responders-plead-guilty-ransomware-digitalmint/)
- [Ransomware responders plead guilty to using ALPHV in attacks on US organizations](https://therecord.media/ransomware-responders-guilty-plea-using-alphv-blackcat-us-attacks)
- [Rogue employee of Chicago cybersecurity firm pleads guilty to $1.3 million ransomware hack](https://chicago.suntimes.com/the-watchdogs/2025/12/23/chicago-digitalmint-hack-cybersecurity-ransomware-kevin-tyler-martin-sygnia-miami)
- [Chicago firm that resolves ransomware attacks had rogue workers carrying out their own hacks, FBI says](https://chicago.suntimes.com/the-watchdogs/2025/11/02/crytpo-cryptocurrency-crime-chicago-digital-mint-ransom-ransomware-hack)
- [DOJ accuses US ransomware negotiators of launching their own ransomware attacks](https://techcrunch.com/2025/11/03/doj-accuses-us-ransomware-negotiators-of-launching-their-own-ransomware-attacks/)
- [Two US cybersecurity experts sentenced in ransomware case, third awaits July ruling](https://securityaffairs.com/191591/cyber-crime/two-us-cybersecurity-experts-sentenced-in-ransomware-case-third-awaits-july-ruling.html)
- [Third ransomware pro pleads guilty to cybercrime U-turn](https://www.theregister.com/security/2026/04/21/third-ransomware-pro-pleads-guilty-to-cybercrime-u-turn/5222277)
- [#StopRansomware: ALPHV Blackcat](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a)
- [BlackCat, Software S1068](https://attack.mitre.org/software/S1068/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1166