When an organization hires a ransomware negotiator, it expects an expert who will fight to minimize the ransom demand. What it does not expect is that the negotiator is secretly working with the attackers to drive the payment higher. That is exactly what happened to multiple victims of the BlackCat (ALPHV) ransomware group between April and September 2023, and the man behind the betrayal is now headed to federal prison.<\/p>\n
Angelo John Martino III, 41, worked as a ransomware negotiator for DigitalMint, an incident response company based in Chicago. His job was to negotiate with ransomware gangs on behalf of victim organizations. But starting in April 2023, Martino began living a double life. Using a hidden tab within the same BlackCat negotiation panel he used for legitimate work, he fed the criminals confidential information: insurance policy limits, negotiating positions, and financial circumstances.<\/p>\n
Martino secretly tipped off a BlackCat affiliate that a victim’s insurance company had approved only a limited payout. In the official negotiation chat \u2014 visible to his employer and the victim \u2014 he played the role of a concerned intermediary while the gang already knew their limit. The BlackCat operator’s message in that chat was explicit: “We know how much you can pay. Contact your insurance. We know about them also.” That victim, a hospitality company, paid nearly US $16.5 million.<\/p>\n
In total, five of Martino’s clients made more than US $75.3 million in ransom payments between April and September 2023. A non-profit paid nearly US $26.8 million, and a financial services firm paid nearly US $25.7 million. Each payment was likely inflated by the information Martino shared.<\/p>\n
Martino also directly deployed BlackCat ransomware against victims alongside Kevin Martin, another DigitalMint negotiator, and Ryan Goldberg, an incident response manager at Sygnia. The trio kept 80 percent of ransoms and paid 20 percent to the BlackCat gang, extorting US<\/a> $1.2 million from a medical device company. In April 2026, Martin and Goldberg were each sentenced to four years in prison.<\/p>\n A federal judge sentenced Martino to 70 months in prison. He spent the cryptocurrency proceeds on two Florida properties, a boat, and several vehicles. Authorities seized US $10 million<\/a> of his assets, and a September hearing will determine additional restitution.<\/p>\nSentencing and Seized Assets<\/h2>\n