# Insider Threat: Ransomware Negotiator Angelo Martino Worked for BlackCat/ALPHV Against Victims

> Angelo Martino, a ransomware negotiator at a U.S. incident response firm, secretly passed victims' negotiation positions and insurance limits to BlackCat/ALPHV operators while negotiating on the victims' behalf. He was sentenced to 70 months in federal prison on July 9, 2026; co-defendants Ryan Goldberg and Kevin Martin, who deployed BlackCat ransomware as affiliates, received 48 months each.

- **Published:** 2026-10-17T17:02:15Z
- **Last reviewed:** 2026-10-17T17:02:15Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3824
- **ID:** TL-2026-3824
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** RESOLVED
- **Actor:** BlackCat
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Angelo John Martino III (41, Land O'Lakes, Florida) was employed as a ransomware negotiator at a U.S. cyber incident response firm. Bitdefender and Help Net Security name the firm as DigitalMint (Chicago); SecureWorld and the DOJ release describe it only as a U.S. incident response company. Victims hired the firm to negotiate with BlackCat/ALPHV, and unknowingly had Martino assigned to their cases. According to the DOJ, Martino instead gave BlackCat actors confidential client information: the victims' negotiation strategies, willingness to pay and insurance policy limits. The operators used it to adjust demands and pressure victims into larger payments. Bitdefender reports that Martino kept a hidden tab inside the same BlackCat negotiation panel the victims were using, and received a cut of the ransom payments.

The DOJ states that five ransomware victims were affected. Bitdefender reports that the five clients paid a combined $75.3 million between April and September 2023, itemized as roughly $16.5 million (hospitality company), $26.8 million (non-profit), $25.7 million (financial services company) and the remainder from the other clients. SecureWorld cites a single extortion of about $1.2 million in Bitcoin, which Bitdefender attributes to a medical device company attacked directly by the trio. These sources differ on the totals and on the end of the conspiracy: the DOJ and SecureWorld say April-November 2023, while Bitdefender says April-September 2023. Both dates are recorded and the discrepancy is not resolved here.

Beyond leaking intelligence, Martino, Kevin Tyler Martin (36, Texas, also a DigitalMint negotiator per Bitdefender) and Ryan Clifford Goldberg (Georgia, an incident response manager at Sygnia per Bitdefender and Help Net Security) deployed ALPHV BlackCat ransomware themselves as affiliates. Per the DOJ, they locked networks and stole sensitive data. They kept 80% of proceeds and paid 20% to the ALPHV administrators. Goldberg and Martin pleaded guilty in December 2025 and Martino pleaded guilty on April 14, 2026, to conspiracy to obstruct, delay or affect commerce by extortion (maximum 20 years). Goldberg and Martin were sentenced to 48 months each around April 30-May 1, 2026; the sources give both dates. Martino was sentenced to 70 months on July 9, 2026. Over $10 million in assets was forfeited or seized, including digital currency, vehicles, a food truck and a fishing boat. The investigation was led by FBI Miami with the U.S. Secret Service and DOJ CCIPS. The FBI's December 2023 BlackCat disruption provided a decryption tool the DOJ says saved victims about $99 million.

Defensive relevance: this is a trusted-third-party compromise of the incident response and negotiation channel. No CVEs, network infrastructure IOCs or malware hashes appear in the sources, so BeaconBeagle correlation was not applicable. Mitigations are procedural: vetting and segregation of duties for negotiators, limiting disclosure of insurance limits, and out-of-band verification of negotiation channels.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1213 Data from Information Repositories
- T1588 Obtain Capabilities
- T1657 Financial Theft

## Sources

- [Ransomware Negotiator Secretly Worked Both Sides—then Joined the Conspiracy](https://www.secureworld.io/industry-news/ransomware-negotiator-secretly-worked-both-sides)
- [The ransomware negotiator who was working for the other side](https://bitdefender.com/en-us/blog/hotforsecurity/ransomware-negotiator-working-other-side)
- [DOJ: Florida Ransomware Negotiator Who Extorted and Attacked Multiple U.S. Victims Sentenced to Prison](https://www.justice.gov/opa/pr/florida-ransomware-negotiator-who-extorted-and-attacked-multiple-us-victims-sentenced-prison)
- [DOJ: Two Americans Who Attacked Multiple U.S. Victims Using ALPHV BlackCat Ransomware Sentenced](https://www.justice.gov/opa/pr/two-americans-who-attacked-multiple-us-victims-using-alphv-blackcat-ransomware-sentenced)
- [Ransomware negotiator who betrayed clients sentenced to 70 months in prison](https://www.helpnetsecurity.com/2026/07/13/ransomware-negotiator-blackcat-sentence/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3824