Update (July 10, 2026): A federal judge has sentenced former ransomware negotiator Angelo Martino to 70 months in prison after he admitted to secretly assisting the BlackCat (ALPHV) ransomware operation during active extortion negotiations. Prosecutors said Martino shared confidential victim information, including insurance policy limits and internal negotiation strategies, allowing the ransomware group to demand higher payments. The Department of Justice also confirmed that authorities have seized approximately $10 million in assets allegedly tied to the scheme, including cryptocurrency, vehicles, a luxury fishing boat, and a food truck. A restitution hearing is scheduled for September 17, 2026.
A Florida man who worked as a ransomware negotiator has pleaded guilty to conspiracy charges after secretly collaborating with the BlackCat (ALPHV) ransomware group while advising victim organizations, according to the U.S. Department of Justice. Prosecutors say he used his position inside active incident response engagements to assist attackers during ransomware events, effectively operating on both sides of the attack.
Insider role exploited during active ransomware incidents
According to court documents, the defendant was employed in a role that involved negotiating with ransomware groups on behalf of victim organizations. These negotiations typically take place during high-pressure incidents where companies rely on external specialists to manage communications, assess demands, and attempt to reduce ransom payments.
Authorities allege that while serving in this trusted position, the individual simultaneously worked with ransomware affiliates linked to the BlackCat operation. This dual role gave him direct visibility into sensitive discussions between victims and attackers, including internal decision-making processes.
The arrangement allowed him to act as an intermediary while covertly supporting the threat actors, without the knowledge of his employer or the organizations he was hired to assist.
Confidential negotiation data shared to maximize ransom demands
Prosecutors say the individual provided ransomware operators with confidential information obtained during multiple negotiations. This reportedly included details about victims’ internal assessments of the incident, their willingness to pay, and cyber insurance policy limits.
Access to this type of information can significantly alter the dynamics of a ransomware negotiation. By understanding a victim’s financial thresholds and negotiation posture, attackers are better positioned to adjust their demands, prolong negotiations, or apply targeted pressure to increase the likelihood of payment.
The Department of Justice indicated that the defendant was involved in several separate incidents, using his role to influence outcomes in favor of the attackers.
Case highlights insider threat risks in incident response services
The case underscores a rarely exposed risk within the ransomware response ecosystem. Organizations frequently depend on third-party negotiators and incident response firms during cyberattacks, often under urgent conditions that limit their ability to independently verify how negotiations are conducted.
These engagements typically involve access to highly sensitive information, including financial data, legal strategy, and internal communications. The alleged abuse of that access demonstrates how insider threats can extend beyond traditional IT roles into external service providers.
While security researchers have long warned that the ransomware economy can create blurred lines between different actors in the ecosystem, confirmed criminal cases involving negotiators actively assisting attackers remain uncommon.
Broader implications for ransomware response and oversight
The incident is likely to raise new questions around oversight, vetting, and accountability for third-party firms involved in ransomware response. As organizations continue to outsource negotiation and incident handling, ensuring trust and transparency in those relationships becomes increasingly critical.
The Department of Justice has not indicated whether additional individuals or organizations are under investigation in connection with the conspiracy, but the case signals increased scrutiny on the broader ransomware support ecosystem.
Former negotiator sentenced
On July 10, the U.S. Department of Justice announced that Martino was sentenced to 70 months in federal prison for conspiring with the BlackCat ransomware group. Prosecutors described him as a “double agent” who secretly worked against the interests of the organizations that hired him to negotiate ransomware demands.
According to court filings, Martino provided BlackCat operators with confidential information gathered during negotiations, including victims’ cyber insurance limits and internal discussions about their willingness to pay. Prosecutors said the information helped the ransomware group maximize extortion payments.
The Justice Department also confirmed that investigators have seized approximately $10 million in assets allegedly purchased with proceeds from the conspiracy, including cryptocurrency, vehicles, a food truck, and a luxury fishing boat. A separate restitution hearing is scheduled for September 17 to determine how much Martino must repay to victims.
The sentencing follows earlier convictions of Ryan Goldberg and Kevin Martin, who each received four-year prison sentences for their roles in deploying BlackCat ransomware during the conspiracy.
