A Land O’Lakes man who worked as a ransomware negotiator pleaded guilty on Apr. 20 to conspiring with others to deploy ransomware and extort U.S. victims, according to federal authorities.
The case highlights the risks posed when trusted cybersecurity professionals exploit their positions for criminal gain, impacting both companies seeking help after cyberattacks and the broader incident response industry.
Court documents show that Angelo Martino, 41, assisted operators of the Blackcat/ALPHV (BlackCat) ransomware by providing them with confidential information about his clients' negotiating strategies while working at a U.S.-based cyber incident response company. This information allowed attackers to maximize ransom payments from five different victims. Martino also admitted to conspiring with Ryan Goldberg of Georgia and Kevin Martin of Texas—both cybersecurity professionals—to launch BlackCat ransomware attacks across the country between April and November 2023. The group extorted approximately $1.2 million in Bitcoin from one victim and laundered their share of the ransom through various means.
Authorities have seized $10 million in assets from Martino, including digital currency, vehicles, a food truck, and a luxury fishing boat obtained using proceeds from these offenses.
“Angelo Martino’s clients trusted him to respond to ransomware threats and help thwart and remedy them on behalf of victims,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “Instead, he betrayed them and began launching ransomware attacks himself by assisting cyber criminals and harming victims, his own employer, and the cyber incident response industry itself.”
“Ransomware victims turned to this defendant for help, and he sold them out from the inside,” said U.S. Attorney Jason A. Reding Quiñones for the Southern District of Florida. “As he admitted in court, he abused his position at a cyber incident response company to feed confidential information to BlackCat actors... This guilty plea makes clear that if you weaponize insider access... you will be prosecuted.”
Assistant Director Brett Leatherman of the FBI’s Cyber Division said: “That includes apprehending key facilitators like Angelo Martino... His guilty plea demonstrates that...the threat is also here in the United States.”
Martino faces up to 20 years in prison when sentenced July 9; Goldberg and Martin entered similar pleas last December with sentencing set for April 30.
The Justice Department previously disrupted BlackCat operations by developing decryption tools that helped hundreds of victims restore systems without paying ransoms—saving an estimated $99 million—and seizing several related websites.
The U.S. Attorney for the Southern District of Florida oversees federal prosecutions—including criminal cases like this one—across nine counties covering about 15,197 square miles serving more than seven million residents through branch offices in Fort Lauderdale, West Palm Beach, Fort Pierce, Key West according to its official website. The office operates under the Department of Justice with over two hundred assistant attorneys handling both civil litigation for government interests as well as debt collection efforts according to its official website.
