Ransomware Negotiator's Betrayal
A former ransomware negotiator for DigitalMint, Angelo John Martino III, has been sentenced to 70 months in jail for deceiving his employer's clients and conspiring with ransomware affiliates to extort a combined $75.3 million from five US companies.
Martino shared confidential information he gained from his work as a ransomware negotiator, including victim organizations' negotiating positions and insurance policy limits, to extract the maximum payment for himself and other BlackCat affiliates he colluded with in backchannels.
Exploiting Trust
Five of Martino's victims hired DigitalMint, which assigned the 41-year-old to conduct ransomware negotiations on their clients' behalf — a rare position he exploited to play both sides, effectively conducting ransomware negotiations with himself and his co-conspirators.
The five victims, all of which paid a ransom between April 2023 and September 2023, include a nonprofit that paid a nearly $26.8 million ransom, a financial services company that paid nearly $25.7 million, and a hospitality company that paid almost $16.5 million.
Background and Investigation
DigitalMint hired Martino in 2022 after he was already engaging in criminal activity, according to court records. The husband and father of two young children had a long history as a cybersecurity professional, dating back to at least 2015, with previous stints at Booz Allen Hamilton, Tracepoint, and TRM Labs.
Martino surrendered to US Marshals in March, was released on a $500,000 bond, and pleaded guilty in April to conspiracy to obstruct, delay or affect commerce or the movement of any article or commodity in commerce by extortion.
Co-Conspirators and Ransomware Attacks
Martino also admitted to conspiring with Kevin Tyler Martin, another former ransomware negotiator at DigitalMint, and Ryan Clifford Goldberg, a former manager of incident response at Sygnia, to deploy BlackCat ransomware, also known as ALPHV, against five additional US companies between April and November 2023.
Goldberg and Martin pleaded guilty in December to participating in a series of ransomware attacks and were each sentenced in April to four years in prison.
DigitalMint's Response
DigitalMint insists it had no knowledge of Martino's criminal acts. The company maintains that it immediately terminated Martino and suspended his access to systems when the Justice Department notified the company it was investigating him in April 2025.
DigitalMint has yet to directly answer questions about whether it refunded its clients who were victimized by Martino, citing confidentiality obligations.
Case Implications
The case against Martino showcases an extreme, albeit rare, example of the dark underbelly of ransomware negotiation as a practice. The pitfalls of ransomware negotiation are excessive, and these backchannel negotiations, which remain largely unscrutinized, can go awry for various reasons.
Prosecutors describe Martino as a 'double agent' driven by greed, who obtained an ALPHV affiliate account that he shared with his co-conspirators and received a portion of the ransomware payments for his involvement in the conspiracy.
Seized Assets and Restitution
Authorities have seized $10 million in assets, including a bayfront home with an estimated value of $1.68 million, a second single-family home with an estimated value of $396,000, and cryptocurrency wallets controlled by Martino.
Law enforcement also seized multiple vehicles, a food truck, and a 29-foot luxury fishing boat that Martino obtained using proceeds from his crimes.
Martino is scheduled to return to court on September 17 to determine the amount of restitution ordered against him for his crimes.
Angelo Martino's victims shared heartbreaking accounts of how their businesses were nearly destroyed, while the people they hired to help them instead betrayed them to ransomware gangs - A. Tysen Duva, assistant attorney general at the Justice Department's Criminal Division
Source: CyberScoop