Threat reportRansomwareTL-2026-3373
Ransomware negotiator Angelo Martino (DigitalMint) charged with BlackCat/ALPHV affiliate extortion scheme
Ransomware negotiator Angelo Martino (DigitalMint) charged (TL-2026-3373), also tracked as DigitalMint negotiator BlackCat case, is a high-severity ransomware operation, first published 2026-10-12. It is attributed to BlackCat with high confidence, affects Various U.S. organizations hit by BlackCat/ALPHV ransomware (medical, maps to 4 MITRE ATT&CK techniques (T1199, T1588.001, T1591), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 4MITRE ATT&CK
- Actors
- 2BlackCat
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-3373
- Threat ID
- TL-2026-3373
- Also known as
- DigitalMint negotiator BlackCat case, BlackCat insider affiliate case
- Severity
- HIGH
- Status
- MONITORING
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- BlackCat, ALPHV affiliates
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- health, pharmacy, legal, education, finance, nonprofit, manufacturing, defense
- Target regions
- North America
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in Ransomware negotiator Angelo Martino (DigitalMint) charged
Malware and tooling: BlackCat (Windows), BlackCat - S1068
How Ransomware negotiator Angelo Martino (DigitalMint) charged works
Angelo Martino, a ransomware negotiator at DigitalMint, was charged with conspiracy to interfere with interstate commerce by extortion for allegedly acting as a BlackCat/ALPHV affiliate while leaking confidential negotiation details of the victims he represented. He worked with Kevin Tyler Martin (former DigitalMint) and Ryan Goldberg (former Sygnia incident response manager). Reported activity ran from April 2023 and affected at least five U.S. organizations.
Angelo Martino, 41, of Land O'Lakes, Florida, was a ransomware negotiator at the incident response firm DigitalMint. He surrendered to U.S. Marshals on 2026-03-10 and was charged with one count of conspiracy to interfere with interstate commerce by extortion. Unsealed court documents allege he shared confidential information about ongoing negotiations with BlackCat/ALPHV operators. Per The Record and Security Affairs, that information included insurance limits and negotiation strategies, and it was used to maximize ransom payments. Security Affairs describes him as a 'double agent'.
Martino's co-conspirators were Kevin Tyler Martin (a DigitalMint negotiator) and Ryan Clifford Goldberg (a Sygnia incident response manager). They were indicted in October 2025 in the Southern District of Florida on charges of conspiracy to interfere with interstate commerce by extortion, interference with interstate commerce by extortion, and intentional damage to protected computers. Per BleepingComputer, the group operated as BlackCat/ALPHV affiliates. They paid BlackCat administrators 20% of the ransoms collected in return for access to the ransomware and the extortion portal. The indictment alleges they gained unauthorized access to victim networks, stole data, deployed encryption malware and demanded cryptocurrency for decryption keys and deletion of the stolen data. Named victims include a Tampa medical device manufacturer, a Maryland pharmaceutical company, a California doctor's office, a California engineering firm and a Virginia drone manufacturer. BleepingComputer also lists medical facilities, law firms, school districts and financial services firms among the victims.
Reported financials differ by source. BleepingComputer reports ransoms paid of $26,793,000 by a nonprofit and $25,660,000 by a financial services firm. The Record reports ransoms negotiated by Martino of about $26 million, $25 million, $16 million and $6 million. One victim, a Florida/Tampa medical company, paid about $1.2-1.27 million in cryptocurrency. Other sources say the remaining victims were not successfully extorted. Sources also give different date ranges for the conduct (April 2023 to April 2025 per BleepingComputer; April to November 2023 per Security Affairs). DigitalMint was told of the DOJ investigation in April 2025 and fired Martino in June 2025. Goldberg and Martin pleaded guilty (reported as December 2025 or January 2026). Later reporting says Martino pleaded guilty on 2026-04-20 and was sentenced to 70 months in prison, with about $10 million in assets seized (cryptocurrency, vehicles, a food truck and a boat) and a restitution hearing scheduled. The verified sources contain no CVEs, network IOCs or malware hashes. This is a trusted-third-party and insider abuse case: the risk lies in the incident response and negotiation supply chain, not in a software flaw.
MITRE ATT&CK techniques used in TL-2026-3373
Initial Access
Resource Development
T1588.001 Obtain Capabilities: Malware
Reconnaissance
T1591 Gather Victim Org Information
Impact
Affected products and versions in Ransomware negotiator Angelo Martino (DigitalMint) charged
- Various — U.S. organizations hit by BlackCat/ALPHV ransomware (medical device, pharmaceutical, medical practice, engineering, drone manufacturing, nonprofit, financial services)
Remediation for Ransomware negotiator Angelo Martino (DigitalMint) charged
Immediate actions
- Ask negotiation and incident response vendors to disclose how they restrict access to client cyber insurance limits, financial data and negotiation strategy
- Limit what insurance and financial detail negotiators can see to what each task requires, and log all access to it
- Review recent ransom negotiations handled by third-party firms for unexplained escalations in demands
Longer-term hardening
- Add vendor background checks, conflict-of-interest declarations and insider-threat monitoring clauses to IR retainer and negotiator contracts
- Separate negotiation strategy and payment authority from the people handling the technical response
- Keep tested offline backups so paying a ransom is a business choice and not the only way to recover
Timeline of Ransomware negotiator Angelo Martino (DigitalMint) charged
- Alleged BlackCat/ALPHV affiliate activity and Martino's sharing of confidential negotiation information begin (April 2023; month precision).
- FBI disrupts BlackCat/ALPHV and releases a decryptor (December 2023; month precision). Security Affairs says the tool saved victims about $99 million in ransoms.
- DigitalMint is informed of the DOJ investigation (April 2025; month precision).
- DigitalMint fires Martino (June 2025; month precision).
- Kevin Tyler Martin and Ryan Goldberg are indicted in the Southern District of Florida on extortion conspiracy and computer damage charges (October 2025; publicly reported 2025-11-04).
- Angelo Martino surrenders to U.S. Marshals and is charged with conspiracy to interfere with interstate commerce by extortion.
- BleepingComputer reports the unsealed charges against Martino.
- Search-result reporting says Martino pleaded guilty on this date. Security Affairs later reports a 70-month prison sentence.
Sources cited for Ransomware negotiator Angelo Martino (DigitalMint) charged
- US charges another ransomware negotiator linked to BlackCat attacks
- The Record: DOJ charges ransomware negotiator in BlackCat case
- Help Net Security: Former ransomware negotiators allegedly targeted US firms with ALPHV/BlackCat ransomware
- Security Affairs: Former Ransomware Negotiator Sentenced to 70 Months in Prison for Secretly Helping BlackCat Gang
- BleepingComputer: US cybersecurity experts indicted for BlackCat ransomware attacks
Detection coverage for TL-2026-3373
As of 2026-10-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3373 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.