Ransomware negotiator for BlackCat group pleads guilty

Angelo Martino is the third ransomware negotiator to be charged for involvement with the BlackCat ransom group.

What happened

On April 20th, 2026, Angelo Martino, age 41, entered a guilty plea for his role in helping conduct BlackCat ransomware attacks against US companies in 2023.

Martino worked as a negotiator for incident response firm DigitalMint, which helps victimized organizations navigate threat intelligence and responses to ransomware groups. Unbeknownst to DigitalMint, Maritno was working with BlackCat, effectively handling deals on behalf of both sides.

Martino pleaded guilty to one count of conspiracy to obstruct, delay, or affect commerce or the movement of any article or commodity in commerce by extortion. Martino will be sentenced on July 9th and faces a maximum penalty of 20 years in prison.

Martino has two co-conspirators, Ryan Goldberg and Kevin Martin, who have already pled guilty after being charged under a separate indictment.

Going deeper

According to the U.S. Department of Justice, Martino negotiated on behalf of five ransomware victims. Martino would then provide confidential information to BlackCat about his client’s negotiating strategies, including key information about the victim’s insurance policy limits. This information helped BlackCat determine the best way to continue ransomware negotiations. All five of the negotiations Martino assisted in resulted in a ransom being paid. Martino was compensated for providing this information to BlackCat.

Martino, alongside Goldberg and Martin, also helped deploy BlackCat ransomware between April 2023 and November 2023. In one instance, the three criminals extorted one victim for approximately $1.2 million in Bitcoin, splitting the funds amongst themselves. Law enforcement has now seized $10 million in assets from Martino.

What was said

According to the Assistant Attorney, General A. Tysen Duva of the Justice Department Criminal Division, “Angelo Martino’s clients trusted him to respond to ransomware threats and help thwart and remedy them on behalf of victims. Instead, he betrayed them and began launching ransomware attacks himself by assisting cyber criminals and harming victims, his own employer, and the cyber incident response industry itself.”

US Attorney Jason A. Reding Quiñones for the Southern District of Florida said, “This guilty plea makes clear that if you weaponize insider access and cybersecurity expertise against victims in South Florida or anywhere in this country, you will be prosecuted. And as the seizure of more than $10 million in assets shows, you will not get to keep the proceeds of your crime.”

Finally, Assistant Director Brett Leatherman of the FBI’s Cyber Division said, “The FBI works every day to dismantle the ransomware ecosystem…His guilty plea demonstrates that, for all the international aspects of cybercrime, the threat is also here in the United States.”

The big picture

The plea from Martino follows the Justice Department’s increased efforts to disrupt prolific ransomware groups, especially BlackCat (also known as ALPHV or Noberus). These efforts have spanned multiple years, like how in 2023, the FBI developed a decryption tool to help organizations decrypt data encrypted by Blackcat.

While the FBI has been actively dismantling BlackCat, it’s still one of the most well-known ransomware groups, having caused disruptions across multiple critical industries, like government facilities, emergency services, schools, and other public health facilities. In particular, BlackCat made waves for its attack against Change Healthcare, which resulted in the healthcare organization paying the malicious group $22 million. Despite the FBI’s involvement, ransomware organizations are constantly evolving to evade government action and make their attacks harder to thwart. Nevertheless, the arrest of Martino and his co-conspirators could help discourage others from participating in the ransomware gang’s activity.

FAQs

Are there still other individuals in the BlackCat ransomware group?

Yes, the BlackCat group is a major threat group that operates internationally. Currently, the FBI is offering a $15 million award for anyone who can help identify major leaders in the group. While Martino’s role was significant, he is far from the only major player.

What will happen to the seized money?

The seized money may go back to the victims who paid it. If it becomes difficult to determine who is owed the money, it may be forfeited to law enforcement, who may put it towards the federal, state, or local level.