Ransomware Negotiator Jailed for Aiding BlackCat Attacks

Key Takeaways

• A former ransomware negotiator was sentenced to 70 months in federal prison for colluding with the BlackCat/ALPHV ransomware group.
• Angelo Martino, employed by a U.S. incident response firm, leveraged confidential client information to aid attackers.
• Martino, along with two co-conspirators, deployed BlackCat ransomware against U.S. organizations, extorting one victim for approximately $1 million in Bitcoin.
• The case underscores the significant insider threat potential within cyber incident response operations.

A former ransomware negotiator from Florida has received a 70-month federal prison sentence for his involvement in a scheme that saw him conspire with the notorious BlackCat/ALPHV ransomware collective to compromise and extort multiple U.S. entities.

Angelo Martino, residing in Land O’Lakes, Florida, was formerly employed by a U.S.-based cyber incident response company. His professional duties included assisting organizations in recovering from ransomware attacks and engaging with threat actors on their behalf.

However, prosecutors revealed that Martino exploited his privileged access to sensitive client data, using it to assist the very cybercriminals who were targeting these victims.

According to the U.S. Department of Justice, Martino initiated his collaboration with BlackCat operatives in April. He allegedly provided the ransomware group with critical intelligence regarding victims’ negotiation tactics, financial standing, and planned responses to ransom demands.

Insider Threat Exposes Vulnerabilities in Incident Response

This confidential information significantly bolstered the attackers’ leverage, enabling them to exert greater pressure on victims and demand higher ransom payments. The BlackCat ransomware operation, also known by its ALPHV moniker, functioned as a ransomware-as-a-service (RaaS) platform.

Under this model, the group’s developers supplied the necessary malware and infrastructure to affiliates, who were then responsible for executing network intrusions, exfiltrating data, encrypting systems, and demanding cryptocurrency payments.

BlackCat quickly rose to prominence as one of the most destructive ransomware operations globally. Martino’s conspiracy extended to include Kevin Martin of Texas and Ryan Goldberg of Georgia, both of whom were also former cybersecurity professionals.

Between April and November, the trio actively deployed BlackCat ransomware against additional U.S. organizations. Prosecutors stated that they successfully extorted one victim for an estimated $1 million in Bitcoin.

The conspirators divided their share of the ransom payment into three portions and employed various methods to launder the cryptocurrency proceeds.

Martino entered a guilty plea in April to one count of conspiracy to interfere with interstate commerce through extortion. Martin and Goldberg had previously been sentenced to prison terms in May.

Law enforcement agencies have successfully seized over $1 million in assets linked to Martino, including digital currency, vehicles, a food truck, and a luxury fishing boat. Authorities confirmed that these assets were acquired through the proceeds of the extortion scheme. A restitution hearing for Martino is scheduled for September.

This case starkly illustrates the insider threat that can materialize within ransomware response efforts. Incident response providers are often entrusted with highly sensitive information, such as assessments of a victim’s ability to pay a ransom, insurance details, recovery strategies, internal communications, and negotiation limits.

The unauthorized disclosure of such information can directly enhance an attacker’s capacity to extort a victim. The investigation was spearheaded by the FBI Miami Field Office, with crucial support from the U.S. Secret Service.

This prosecution forms part of Operation Riptide, an FBI initiative targeting cybercrime actors, their infrastructure, financial networks, and fraudulent operations. The Justice Department had previously disrupted BlackCat’s infrastructure in December. During that operation, the FBI developed a decryption tool that aided hundreds of victims in restoring their encrypted systems and reportedly prevented approximately $68 million in potential ransom payments.

What You Should Do

• Implement Robust Insider Threat Programs: Establish comprehensive programs to monitor employee behavior, particularly those with access to sensitive client data or critical systems.
• Strengthen Vendor Due Diligence: Thoroughly vet all third-party incident response providers, including background checks on key personnel and regular security audits of their practices.
• Enforce Strict Access Controls: Implement the principle of least privilege for all employees, ensuring access to sensitive information is granted only on a need-to-know basis.
• Encrypt and Segment Sensitive Data: Encrypt confidential client information at rest and in transit, and segment networks to limit lateral movement in case of a breach.
• Conduct Regular Security Awareness Training: Educate employees on the risks of insider threats, social engineering, and the importance of data confidentiality.
• Monitor for Anomalous Activity: Deploy security information and event management (SIEM) systems to detect unusual access patterns or data exfiltration attempts.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.