Ransomware negotiator gets 70 months for aiding BlackCat extortion

A former ransomware negotiator has been sentenced to 70 months in prison after federal prosecutors said he secretly helped BlackCat ransomware operators pressure the same victims he was hired to assist. The case shows how trusted intermediaries in cyber extortion cases can become part of the threat, according to court filings.

Angelo Martino, 41, of Florida, worked for DigitalMint, a company that helps ransomware victims negotiate and settle cryptocurrency payments, according to the U.S. government. Prosecutors said Martino’s role was to reduce ransom demands for clients, but he instead passed confidential negotiation details to attackers in return for a cut of the payments.

Five DigitalMint clients represented by Martino paid more than $75 million to ransomware affiliates, prosecutors said in a sentencing memorandum. The government said some of those payments likely included millions of dollars in added ransom demands driven by information Martino supplied.

Client information went to attackers, prosecutors said

According to a factual proffer signed by Martino and prosecutors, Martino worked at DigitalMint from November 2022 to April 2025, first as an independent consultant and later as a full-time employee. Prosecutors said he received information about attacks, ransom demands, insurance coverage and negotiating plans as part of his job.

Beginning in April 2023, Martino communicated with BlackCat actors through Tox and through a separate intermediary chat in the BlackCat panel, according to the court filing. Prosecutors said that private channel was available only to Martino and the BlackCat negotiators and affiliates.

Through those communications, the government said, Martino gave attackers details such as insurance limits and internal negotiating positions without victims’ knowledge. In exchange, prosecutors said, he received cryptocurrency from ransom payments.

The affected DigitalMint clients included a hospitality company, a nonprofit, a financial services company, a retail company and a medical company, according to the government. Prosecutors said victims paid ransoms ranging from $213,000 to $26.8 million between April and September 2023, and that the scheme disrupted services at companies including financial and health-related businesses.

Separate attacks also alleged

Martino pleaded guilty after being charged in February with conspiracy to interfere with interstate commerce by extortion, prosecutors said. The charge carried a maximum prison term of 20 years, while federal guidelines cited by the government put the recommended range at 70 to 87 months.

Martino sought a 24-month sentence, saying he helped authorities build cases against two co-defendants, according to defense filings. Those co-defendants, Texas resident Kevin Martin, another DigitalMint ransomware negotiator, and Georgia resident Ryan Goldberg, an incident manager at Sygnia, were each sentenced in April 2026 to four years in prison, according to the Justice Department.

Federal prosecutors also said Martino used his ransomware knowledge and contacts to obtain BlackCat affiliate access for himself, Martin and Goldberg. The government said the three used that access to attack five additional victims and collected one $1.2 million payment from a medical device company; prosecutors said the other victims did not pay but still suffered losses.

BlackCat, also known as ALPHV, used affiliates to deploy ransomware and share proceeds with administrators, according to the government. The FBI has said it developed a decryption tool for victims and seized several sites used by the group in 2023, and the U.S. government is still offering rewards of up to $10 million for information on BlackCat administrators and affiliates.

Company says it cooperated

To compensate victims, Martino must forfeit property and pay 10 percent of any salary he earns after prison, according to court filings. Prosecutors said he received millions of dollars in cryptocurrency and that the FBI seized some of it, though Martino had already used proceeds to buy two Florida houses, a boat and several vehicles.

DigitalMint said in a statement that it did not know about Martino’s conduct while he was employed there and fired the employees involved after learning of the allegations from the Justice Department. The company said it cooperated with federal authorities and described itself as an unknowing victim of the scheme.

DigitalMint said Martino bypassed internal controls, including background checks and compliance procedures, by using unauthorized channels described in government filings. Sygnia told CNN in November that it fired Goldberg immediately after learning of the matter and was working with the FBI.

This story draws on original reporting from Ars Technica.