# Former Ransomware Negotiator Angelo Martino Sentenced to 70 Months for Colluding with BlackCat/ALPHV Operators to Extort $75.3M from Five Victims

> Angelo Martino, a former ransomware negotiator at DigitalMint, was sentenced to 70 months in federal prison for conspiring with BlackCat/ALPHV ransomware operators between April and November 2023, leaking confidential client negotiating positions and insurance limits from five victim organizations to maximize extortion demands totaling $75.3 million. Co-conspirators Kevin Martin (DigitalMint) and Ryan Goldberg (Sygnia) were each sentenced to 48 months for helping deploy BlackCat ransomware against additional victims.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1264
- **ID:** TL-2026-1264
- **Severity:** MEDIUM
- **Category:** THREAT_ACTOR
- **Status:** RESOLVED
- **Actor:** BlackCat
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Angelo John Martino III, 41, of Land O'Lakes, Florida, worked as a ransomware negotiator at Chicago-based incident response firm DigitalMint, where he was hired by victim organizations to negotiate down ransom demands from ransomware operators, including affiliates of the BlackCat/ALPHV Ransomware-as-a-Service (RaaS) operation. Beginning in April 2023, Martino covertly acted as a double agent: while publicly representing his employer's clients in negotiations, he secretly fed BlackCat affiliates confidential information obtained through his negotiator role, including victims' internal negotiating positions and strategy, cyber-insurance policy limits, and internal risk assessments. This intelligence let the ransomware operators calibrate demands to extract the maximum amount each victim could plausibly pay, rather than the amount victims disclosed during negotiation. Martino was paid by the BlackCat actors for this information.

Across five identified victim organizations targeted between April and September 2023 -- a nonprofit organization (~$26.8M paid), a financial services company (~$25.7M paid), a hospitality company (~$16.5M paid), and two additional companies ($6.1M and $213,000 paid) -- Martino's conduct enabled combined extortion payments/demands of approximately $75.3 million. He also received roughly $1.2 million in Bitcoin directly tied to one case and split a $1.3 million ransom from a medical company with co-conspirators.

Martino separately conspired with Kevin Tyler Martin, 36, a fellow DigitalMint ransomware negotiator hired after the scheme began, and Ryan Clifford Goldberg, 33/41 (sources vary), an incident response manager at cybersecurity firm Sygnia, to actively help deploy BlackCat ransomware against at least four additional U.S. victim organizations between April 2023 and November 2023 -- including a financial services firm, a nonprofit, school districts, medical facilities, and law firms. The three received a 20% cut of ransom proceeds paid to BlackCat administrators in exchange for providing initial access, targeting intelligence, and negotiation intelligence. The group threatened to leak stolen data before encrypting victim systems, consistent with BlackCat/ALPHV's standard double-extortion model.

BlackCat/ALPHV, a Rust-based Ransomware-as-a-Service operation first identified in November 2021, is estimated by the FBI and CISA to have collected at least $300 million in ransom payments from over 1,000 victims worldwide before affiliates, including this insider group, continued operations after a partial law-enforcement disruption of BlackCat's infrastructure in December 2023 (a takedown the group publicly claimed was an 'exit scam').

Martino pleaded guilty on April 14, 2026, to a one-count criminal information charging conspiracy to interfere with interstate commerce by extortion (the Hobbs Act), and was sentenced on July 10, 2026 to 70 months in prison by Judge K. Michael Moore in the U.S. District Court for the Southern District of Florida. Martin and Goldberg pleaded guilty in December 2025 to the same charge and were each sentenced on May 1, 2026 to 48 months. Law enforcement (FBI, working with DOJ Criminal Division) seized more than $10 million in assets from Martino tied to the scheme, including a bayfront home (~$1.68M), a second residence (~$396K), luxury vehicles, a food truck, a 29-foot fishing boat, and cryptocurrency wallets. A restitution hearing for Martino is scheduled for September 17, 2026.

DigitalMint stated publicly that Martino's actions were deliberately concealed from the company and violated its values, ethics standards, and the law; it suspended Martino's access in April 2025 upon DOJ notification and said it used industry-standard background-check controls. The case is a significant insider-threat and trust-boundary failure within the incident-response/ransomware-negotiation industry: organizations that hire IR firms to negotiate with ransomware operators on their behalf implicitly trust those firms with highly sensitive financial and strategic data (insurance limits, board risk tolerance, negotiation floors/ceilings), and this case demonstrates that data can be monetized by a corrupted insider working in direct collusion with the same threat actor group the firm was ostensibly hired to counter.

## MITRE ATT&CK

- T1585 Establish Accounts
- T1591 Gather Victim Org Information
- T1078 Valid Accounts
- T1566 Phishing
- T1078 Valid Accounts
- T1484 Domain or Tenant Policy Modification
- T1685 Disable or Modify Tools
- T1003 OS Credential Dumping
- T1046 Network Service Discovery
- T1213 Data from Information Repositories
- T1074 Data Staged
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1657 Financial Theft
- T1490 Inhibit System Recovery
- T1119 Automated Collection

## Sources

- [Former ransomware negotiator sentenced to prison for conspiring with BlackCat gang](https://www.helpnetsecurity.com/2026/07/13/ransomware-negotiator-blackcat-sentence/)
- [Florida Ransomware Negotiator Who Extorted and Attacked Multiple U.S. Victims Sentenced to Prison](https://www.justice.gov/opa/pr/florida-ransomware-negotiator-who-extorted-and-attacked-multiple-us-victims-sentenced-prison)
- [Florida Man Working as a Ransomware Negotiator Pleads Guilty to Conspiracy to Deploy Ransomware and Extort U.S. Victims](https://www.justice.gov/opa/pr/florida-man-working-ransomware-negotiator-pleads-guilty-conspiracy-deploy-ransomware-and)
- [Former DigitalMint ransomware negotiator who duped clients sentenced to 70 months in jail](https://cyberscoop.com/digitalmint-ransomware-negotiator-angelo-martino-sentenced/)
- [Former DigitalMint ransomware negotiator pleads guilty to extortion scheme](https://cyberscoop.com/digitalmint-ransomware-negotiator-angelo-martino-guilty-plea/)
- [Ex-Chicago ransomware negotiator gets nearly 6 years in prison for aiding hackers](https://chicago.suntimes.com/crime/2026/07/10/ex-chicago-ransomware-negotiator-gets-nearly-6-years-in-prison-for-aiding-hackers)
- [Ransomware Negotiator Gets 70 Months in Prison for Aiding BlackCat Attacks](https://thehackernews.com/2026/07/ransomware-negotiator-gets-70-months-in.html)
- [Former ransomware negotiator sentenced to 70 months for extorting $75.3 million](https://www.scworld.com/brief/former-ransomware-negotiator-sentenced-to-70-months-for-extorting-75-3-million)
- [Former ransomware negotiator gets 4 years for BlackCat attacks](https://www.bleepingcomputer.com/news/security/us-ransomware-negotiator-gets-4-years-in-prison-for-blackcat-attacks/)
- [Ransomware negotiator who conspired with BlackCat threat actors sentenced to 70 months in prison](https://databreaches.net/2026/07/11/ransomware-negotiator-who-conspired-with-blackcat-threat-actors-sentenced-to-70-months-in-prison/)
- [Florida ransomware negotiator convicted for helping ransomware gang extort US companies](https://techcrunch.com/2026/07/10/florida-ransomware-negotiator-convicted-for-helping-ransomware-gang-extort-us-companies/)
- [Former Ransomware Negotiator Sentenced to 70 Months in Prison for Secretly Helping BlackCat Gang](https://securityaffairs.com/195081/cyber-crime/former-ransomware-negotiator-sentenced-to-70-months-in-prison-for-secretly-helping-blackcat-gang.html)
- [Ransomware Negotiator Gets 6 Years in Prison for Assisting Scammers](https://www.pymnts.com/cybersecurity/2026/ransomware-negotiator-gets-6-years-in-prison-for-assisting-scammers)
- [#StopRansomware: ALPHV Blackcat (AA23-353A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1264