# Ransomware negotiator Angelo Martino (DigitalMint) charged with BlackCat/ALPHV affiliate extortion scheme

> Angelo Martino, a ransomware negotiator at DigitalMint, was charged with conspiracy to interfere with interstate commerce by extortion for allegedly acting as a BlackCat/ALPHV affiliate while leaking confidential negotiation details of the victims he represented. He worked with Kevin Tyler Martin (former DigitalMint) and Ryan Goldberg (former Sygnia incident response manager). Reported activity ran from April 2023 and affected at least five U.S. organizations.

- **Published:** 2026-10-12T20:41:23Z
- **Last reviewed:** 2026-10-12T20:41:23Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3373
- **ID:** TL-2026-3373
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** MONITORING
- **Actor:** BlackCat
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Angelo Martino, 41, of Land O'Lakes, Florida, was a ransomware negotiator at the incident response firm DigitalMint. He surrendered to U.S. Marshals on 2026-03-10 and was charged with one count of conspiracy to interfere with interstate commerce by extortion. Unsealed court documents allege he shared confidential information about ongoing negotiations with BlackCat/ALPHV operators. Per The Record and Security Affairs, that information included insurance limits and negotiation strategies, and it was used to maximize ransom payments. Security Affairs describes him as a 'double agent'.

Martino's co-conspirators were Kevin Tyler Martin (a DigitalMint negotiator) and Ryan Clifford Goldberg (a Sygnia incident response manager). They were indicted in October 2025 in the Southern District of Florida on charges of conspiracy to interfere with interstate commerce by extortion, interference with interstate commerce by extortion, and intentional damage to protected computers. Per BleepingComputer, the group operated as BlackCat/ALPHV affiliates. They paid BlackCat administrators 20% of the ransoms collected in return for access to the ransomware and the extortion portal. The indictment alleges they gained unauthorized access to victim networks, stole data, deployed encryption malware and demanded cryptocurrency for decryption keys and deletion of the stolen data. Named victims include a Tampa medical device manufacturer, a Maryland pharmaceutical company, a California doctor's office, a California engineering firm and a Virginia drone manufacturer. BleepingComputer also lists medical facilities, law firms, school districts and financial services firms among the victims.

Reported financials differ by source. BleepingComputer reports ransoms paid of $26,793,000 by a nonprofit and $25,660,000 by a financial services firm. The Record reports ransoms negotiated by Martino of about $26 million, $25 million, $16 million and $6 million. One victim, a Florida/Tampa medical company, paid about $1.2-1.27 million in cryptocurrency. Other sources say the remaining victims were not successfully extorted. Sources also give different date ranges for the conduct (April 2023 to April 2025 per BleepingComputer; April to November 2023 per Security Affairs). DigitalMint was told of the DOJ investigation in April 2025 and fired Martino in June 2025. Goldberg and Martin pleaded guilty (reported as December 2025 or January 2026). Later reporting says Martino pleaded guilty on 2026-04-20 and was sentenced to 70 months in prison, with about $10 million in assets seized (cryptocurrency, vehicles, a food truck and a boat) and a restitution hearing scheduled. The verified sources contain no CVEs, network IOCs or malware hashes. This is a trusted-third-party and insider abuse case: the risk lies in the incident response and negotiation supply chain, not in a software flaw.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1588.001 Obtain Capabilities: Malware
- T1199 Trusted Relationship
- T1657 Financial Theft

## Sources

- [US charges another ransomware negotiator linked to BlackCat attacks](https://www.bleepingcomputer.com/news/security/us-charges-another-ransomware-negotiator-linked-to-blackcat-attacks/)
- [The Record: DOJ charges ransomware negotiator in BlackCat case](https://therecord.media/ransomware-blackcat-doj-incident-responder)
- [Help Net Security: Former ransomware negotiators allegedly targeted US firms with ALPHV/BlackCat ransomware](https://www.helpnetsecurity.com/2025/11/04/ransomware-negotiator-alphv-blackcat-ransomware/)
- [Security Affairs: Former Ransomware Negotiator Sentenced to 70 Months in Prison for Secretly Helping BlackCat Gang](https://securityaffairs.com/?p=195081)
- [BleepingComputer: US cybersecurity experts indicted for BlackCat ransomware attacks](https://www.bleepingcomputer.com/news/security/us-cybersecurity-experts-indicted-for-blackcat-ransomware-attacks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3373