Threat reportRansomwareTL-2026-3824
Insider Threat: Ransomware Negotiator Angelo Martino Worked for BlackCat/ALPHV Against Victims
Insider Threat (TL-2026-3824), also tracked as Ransomware negotiator insider case, is a high-severity ransomware operation, first published 2026-10-17. It is attributed to BlackCat with high confidence, affects Third-party incident response and ransomware negotiation providers, maps to 5 MITRE ATT&CK techniques (T1078, T1199, T1213), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 2BlackCat
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-3824
- Threat ID
- TL-2026-3824
- Also known as
- Ransomware negotiator insider case, DigitalMint/Sygnia BlackCat affiliate case
- Severity
- HIGH
- Status
- RESOLVED
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- BlackCat, ALPHV
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- hospitality, non-profit organisation, finance, health, medical devices
- Target regions
- North America
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in Insider Threat
Malware and tooling: BlackCat (Windows), BlackCat - S1068
How Insider Threat works
Angelo Martino, a ransomware negotiator at a U.S. incident response firm, secretly passed victims' negotiation positions and insurance limits to BlackCat/ALPHV operators while negotiating on the victims' behalf. He was sentenced to 70 months in federal prison on July 9, 2026; co-defendants Ryan Goldberg and Kevin Martin, who deployed BlackCat ransomware as affiliates, received 48 months each.
Angelo John Martino III (41, Land O'Lakes, Florida) was employed as a ransomware negotiator at a U.S. cyber incident response firm. Bitdefender and Help Net Security name the firm as DigitalMint (Chicago); SecureWorld and the DOJ release describe it only as a U.S. incident response company. Victims hired the firm to negotiate with BlackCat/ALPHV, and unknowingly had Martino assigned to their cases. According to the DOJ, Martino instead gave BlackCat actors confidential client information: the victims' negotiation strategies, willingness to pay and insurance policy limits. The operators used it to adjust demands and pressure victims into larger payments. Bitdefender reports that Martino kept a hidden tab inside the same BlackCat negotiation panel the victims were using, and received a cut of the ransom payments.
The DOJ states that five ransomware victims were affected. Bitdefender reports that the five clients paid a combined $75.3 million between April and September 2023, itemized as roughly $16.5 million (hospitality company), $26.8 million (non-profit), $25.7 million (financial services company) and the remainder from the other clients. SecureWorld cites a single extortion of about $1.2 million in Bitcoin, which Bitdefender attributes to a medical device company attacked directly by the trio. These sources differ on the totals and on the end of the conspiracy: the DOJ and SecureWorld say April-November 2023, while Bitdefender says April-September 2023. Both dates are recorded and the discrepancy is not resolved here.
Beyond leaking intelligence, Martino, Kevin Tyler Martin (36, Texas, also a DigitalMint negotiator per Bitdefender) and Ryan Clifford Goldberg (Georgia, an incident response manager at Sygnia per Bitdefender and Help Net Security) deployed ALPHV BlackCat ransomware themselves as affiliates. Per the DOJ, they locked networks and stole sensitive data. They kept 80% of proceeds and paid 20% to the ALPHV administrators. Goldberg and Martin pleaded guilty in December 2025 and Martino pleaded guilty on April 14, 2026, to conspiracy to obstruct, delay or affect commerce by extortion (maximum 20 years). Goldberg and Martin were sentenced to 48 months each around April 30-May 1, 2026; the sources give both dates. Martino was sentenced to 70 months on July 9, 2026. Over $10 million in assets was forfeited or seized, including digital currency, vehicles, a food truck and a fishing boat. The investigation was led by FBI Miami with the U.S. Secret Service and DOJ CCIPS. The FBI's December 2023 BlackCat disruption provided a decryption tool the DOJ says saved victims about $99 million.
Defensive relevance: this is a trusted-third-party compromise of the incident response and negotiation channel. No CVEs, network infrastructure IOCs or malware hashes appear in the sources, so BeaconBeagle correlation was not applicable. Mitigations are procedural: vetting and segregation of duties for negotiators, limiting disclosure of insurance limits, and out-of-band verification of negotiation channels.
MITRE ATT&CK techniques used in TL-2026-3824
Initial Access
T1078 Valid Accounts; T1199 Trusted Relationship
Collection
T1213 Data from Information Repositories
Resource Development
Impact
Affected products and versions in Insider Threat
- Third-party incident response and ransomware negotiation providers — Ransomware negotiation and incident response engagements
Vulnerable versions: Engagements handled April-November 2023 by the implicated negotiators
Remediation for Insider Threat
Immediate actions
- Ask your IR or negotiation provider which staff are assigned to your matter and what background checks and conflict controls apply
- Restrict who learns insurance policy limits and walk-away figures during a negotiation; share them on a need-to-know basis
- Review your own history with ransomware negotiators for unusual outcomes such as demands that tracked policy limits
Workarounds
- Where possible, verify negotiation channel integrity out of band and use more than one independent advisor on high-value matters
Longer-term hardening
- Require negotiation vendors to enforce segregation of duties, two-person review of ransom communications and audit logging of negotiation-panel access
- Contractually require negotiator conflict-of-interest, background-check and insider-threat controls from IR and negotiation providers
- Include third-party negotiators and IR firms in third-party risk and insider-threat programs
Timeline of Insider Threat
- Martino begins working with BlackCat operators while employed as a ransomware negotiator (April 2023; exact day not stated in sources).
- Per Bitdefender, five victims paid a combined $75.3 million between April and September 2023 (end of month used as an approximation; the DOJ and SecureWorld put the conspiracy end in November 2023).
- End of the April-November 2023 conspiracy period stated by the DOJ and SecureWorld (end of month used as an approximation).
- FBI disrupts BlackCat/ALPHV infrastructure and seizes its leak site in December 2023, providing a decryption tool the DOJ says saved victims about $99 million.
- Ryan Goldberg and Kevin Martin plead guilty in December 2025 (exact day not stated in sources).
- Martino pleads guilty to conspiracy to obstruct, delay or affect commerce by extortion.
- SecureWorld publishes the earliest report in our source set on the negotiator working both sides.
- Goldberg and Martin are each sentenced to 48 months in prison (the DOJ announcement is dated April 30, while Help Net Security reports May 1).
- Martino is sentenced to 70 months in federal prison, with over $10 million in assets forfeited or seized.
Sources cited for Insider Threat
- Ransomware Negotiator Secretly Worked Both Sides—then Joined the Conspiracy
- The ransomware negotiator who was working for the other side
- DOJ: Florida Ransomware Negotiator Who Extorted and Attacked Multiple U.S. Victims Sentenced to Prison
- DOJ: Two Americans Who Attacked Multiple U.S. Victims Using ALPHV BlackCat Ransomware Sentenced
- Ransomware negotiator who betrayed clients sentenced to 70 months in prison
Detection coverage for TL-2026-3824
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3824 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.