When an organization hires a ransomware negotiator, it expects an expert who will fight to minimize the ransom demand. What it does not expect is that the negotiator is secretly working with the attackers to drive the payment higher. That is exactly what happened to multiple victims of the BlackCat (ALPHV) ransomware group between April and September 2023, and the man behind the betrayal is now headed to federal prison.
Angelo John Martino III, 41, worked as a ransomware negotiator for DigitalMint, an incident response company based in Chicago. His job was to negotiate with ransomware gangs on behalf of victim organizations. But starting in April 2023, Martino began living a double life. Using a hidden tab within the same BlackCat negotiation panel he used for legitimate work, he fed the criminals confidential information: insurance policy limits, negotiating positions, and financial circumstances.
How a Ransomware Negotiator Betrayed BlackCat’s Victims
Martino secretly tipped off a BlackCat affiliate that a victim’s insurance company had approved only a limited payout. In the official negotiation chat — visible to his employer and the victim — he played the role of a concerned intermediary while the gang already knew their limit. The BlackCat operator’s message in that chat was explicit: “We know how much you can pay. Contact your insurance. We know about them also.” That victim, a hospitality company, paid nearly US $16.5 million.
In total, five of Martino’s clients made more than US $75.3 million in ransom payments between April and September 2023. A non-profit paid nearly US $26.8 million, and a financial services firm paid nearly US $25.7 million. Each payment was likely inflated by the information Martino shared.
Beyond Betrayal: Running Ransomware as an Affiliate
Martino also directly deployed BlackCat ransomware against victims alongside Kevin Martin, another DigitalMint negotiator, and Ryan Goldberg, an incident response manager at Sygnia. The trio kept 80 percent of ransoms and paid 20 percent to the BlackCat gang, extorting US $1.2 million from a medical device company. In April 2026, Martin and Goldberg were each sentenced to four years in prison.
Sentencing and Seized Assets
A federal judge sentenced Martino to 70 months in prison. He spent the cryptocurrency proceeds on two Florida properties, a boat, and several vehicles. Authorities seized US $10 million of his assets, and a September hearing will determine additional restitution.
“Angelo Martino sold out the very victims he was hired to represent,” said FBI Assistant Director Brett Leatherman. “This sentence demonstrates that the FBI will pursue not just the criminals who deploy ransomware, but the insiders who enable them.”
Lessons for the Ransomware Negotiation Industry
US authorities described DigitalMint as an “unknowing victim” — Martino concealed his actions from his employer. The company has since changed how its negotiators communicate with ransomware gangs and is working with the Department of Homeland Security to establish a registry for the largely unregulated ransomware negotiation field.
What Organizations Should Do Now
This case underscores the need for organizations to vet incident response partners thoroughly and maintain independent oversight during ransom negotiations. Ensure all communications between your negotiator and threat actors are logged and auditable by a separate internal team or external counsel. The ransomware negotiation industry remains largely unregulated, and placing blind trust in a single intermediary carries significant risk. Require multi-party approval for any settlement decisions and verify that your negotiator’s communication channels are secured against unauthorized access.
