# Insider Ransomware Negotiators Colluded with BlackCat/ALPHV, Cost Victims $75M+ — DigitalMint's Angelo Martino Sentenced to 70 Months

> Ransomware negotiator Angelo Martino (DigitalMint), with co-conspirators Kevin Martin (DigitalMint) and Ryan Goldberg (Sygnia incident-response manager), secretly fed confidential client negotiation data to BlackCat/ALPHV starting April 2023, then became BlackCat affiliates deploying attacks themselves. Five DigitalMint clients paid a combined $75.3 million; the trio also directly deployed BlackCat against additional victims, splitting roughly $1.3 million from a medical-sector ransom. Martino was sentenced to 70 months on July 3, 2026; Martin and Goldberg each received 48-month sentences on May 1, 2026.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1294
- **ID:** TL-2026-1294
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** RESOLVED
- **Actor:** BlackCat
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Between April and September 2023, Angelo John Martino III, a ransomware negotiator employed by Chicago-based incident-response and ransom-negotiation firm DigitalMint, operated as a covert double agent inside five separate ransomware-response engagements. While formally representing victim organizations in negotiations with the BlackCat/ALPHV ransomware-as-a-service (RaaS) operation, Martino used a hidden communication channel to relay confidential client data directly to BlackCat operators — including victims' cyber-insurance policy limits, internal negotiation strategy, and authorized payment ceilings. In at least one documented instance, Martino told the attackers a victim would pay $2 million more than the victim's actual stated offer, allowing BlackCat to extract inflated ransom payments by negotiating against a script Martino himself was feeding them. The five affected DigitalMint clients — spanning nonprofit, financial services, hospitality, and other sectors — ultimately paid ransoms ranging from $213,000 to $26.8 million, for a combined total of $75.3 million.

Martino's conduct escalated in May 2023 when he registered as a BlackCat/ALPHV affiliate in his own right, paying the ransomware operators roughly 20% of proceeds for access to the BlackCat locker and RaaS infrastructure. He recruited Kevin Tyler Martin, a fellow DigitalMint negotiator hired in 2022 after the conspiracy had already begun, and Ryan Clifford Goldberg, an incident-response manager at the separate IR firm Sygnia, to jointly deploy BlackCat ransomware against additional victims between April and November 2023, independent of the DigitalMint negotiation engagements. This direct-deployment track included an attack on a medical-sector organization that yielded roughly $1.2–1.3 million in ransom, split three ways among the conspirators. The scheme thus combined two distinct insider-abuse vectors against the same trust relationship: (1) betraying the negotiator/incident-responder role to feed an active adversary intelligence that maximized extortion outcomes against the negotiator's own clients, and (2) using that same insider knowledge and RaaS access to directly operate as ransomware affiliates.

BlackCat/ALPHV itself was, at the time, one of the most prolific RaaS operations globally, responsible for over $300 million in ransom proceeds from more than 1,000 victims through September 2023 before its data-leak-site infrastructure was seized by law enforcement in December 2023 (with the FBI subsequently releasing a decryption tool). BlackCat affiliates typically gained initial access via social engineering — including impersonating IT/helpdesk personnel — then used legitimate remote-access tooling and frameworks such as Cobalt Strike and Brute Ratel for command-and-control, Metasploit for defense evasion, and cloud services such as Mega.nz and Dropbox for data exfiltration ahead of double-extortion encryption. The malware itself, written in Rust, is capable of encrypting Windows, Linux, and VMware ESXi environments.

Martino, who had prior cybersecurity roles at Booz Allen Hamilton, Tracepoint, and TRM Labs dating to 2015, pleaded guilty to conspiracy to interfere with interstate commerce by extortion (Hobbs Act extortion conspiracy) and was sentenced on July 3, 2026 to 70 months (approximately 5.8 years) in federal prison — above the low end of federal sentencing guidelines (72–87 months range was reported as the guideline calculation) reflecting the court's characterization of his conduct as 'maximizing the harm to his clients.' Martin and Goldberg pleaded guilty in December 2024 and were each sentenced to 48 months on May 1, 2026. Law enforcement seized roughly $10 million in assets tied to Martino, including a $1.68 million waterfront home, a $396,000 single-family home, cryptocurrency wallets, vehicles, a food truck, and a luxury fishing boat. A restitution hearing for Martino was scheduled for September 17, 2026. DigitalMint stated it had no knowledge of Martino's conduct and that he 'deliberately concealed' his activities from standard industry controls; the firm declined to disclose whether it refunded affected clients. Sygnia did not issue a public statement in reporting reviewed.

The case is a significant supply-chain / third-party-trust risk exemplar for the incident-response and ransom-negotiation industry: it demonstrates that the confidentiality and independence assumptions underlying third-party IR/negotiation engagements can be subverted from within, materially worsening ransomware outcomes for victims who believed they were being represented in good faith against the adversary.

## MITRE ATT&CK

- T1585 Establish Accounts
- T1199 Trusted Relationship
- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1047 Windows Management Instrumentation
- T1548 Abuse Elevation Control Mechanism
- T1134 Access Token Manipulation
- T1070 Indicator Removal
- T1222 File and Directory Permissions Modification
- T1112 Modify Registry
- T1087 Account Discovery
- T1083 File and Directory Discovery
- T1135 Network Share Discovery
- T1069 Permission Groups Discovery
- T1018 Remote System Discovery
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1219 Remote Access Tools
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1489 Service Stop
- T1490 Inhibit System Recovery
- T1491 Defacement
- T1485 Data Destruction
- T1657 Financial Theft

## Sources

- [The inside job that cost ransomware victims millions](https://www.malwarebytes.com/blog/news/2026/07/the-inside-job-that-cost-ransomware-victims-millions)
- [Ransomware negotiator who betrayed clients sentenced to 70 months in prison](https://www.helpnetsecurity.com/2026/07/13/ransomware-negotiator-blackcat-sentence/)
- [Florida Ransomware Negotiator Who Extorted and Attacked Multiple U.S. Victims Sentenced to Prison](https://www.justice.gov/opa/pr/florida-ransomware-negotiator-who-extorted-and-attacked-multiple-us-victims-sentenced-prison)
- [US ransomware negotiator gets 4 years in prison for BlackCat attacks](https://www.bleepingcomputer.com/news/security/us-ransomware-negotiator-gets-4-years-in-prison-for-blackcat-attacks/)
- [Former DigitalMint ransomware negotiator who duped clients sentenced to 70 months in jail](https://cyberscoop.com/digitalmint-ransomware-negotiator-angelo-martino-sentenced/)
- [Ransomware negotiator who ran BlackCat 'double agent' scheme against DigitalMint clients gets nearly six years](https://www.theinsurer.com/cyber-risk/news/ransomware-negotiator-who-ran-blackcat-double-agent-scheme-against-digitalmint-2026-07-13/)
- [Ex-ransomware negotiator gets 70 months for betraying clients to hackers](https://www.washingtontimes.com/news/2026/jul/13/ex-ransomware-negotiator-gets-70-months-betraying-clients-hackers/)
- [Ransomware Negotiator Gets 70 Months in Prison for Aiding BlackCat Attacks](https://thehackernews.com/2026/07/ransomware-negotiator-gets-70-months-in.html)
- [Ex-Chicago ransomware negotiator gets nearly 6 years in prison for aiding hackers](https://chicago.suntimes.com/crime/2026/07/10/ex-chicago-ransomware-negotiator-gets-nearly-6-years-in-prison-for-aiding-hackers)
- [A ransomware negotiator who colluded with attackers to scam victims was sentenced to 70 months in prison](https://www.engadget.com/2214113/ransomware-negotiator-who-colluded-with-attackers-to-scam-victims-was-sentenced-to-70-months-in-prison/)
- [#StopRansomware: ALPHV Blackcat](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a)
- [BlackCat, Software S1068](https://attack.mitre.org/software/S1068/)
- [Response to the Revised CISA Advisory (AA23-353A) - Emulating ALPHV/BlackCat](https://www.attackiq.com/2024/03/07/emulating-alphv-blackcat/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1294