When a company falls victim to a ransomware attack, it rarely turns to the experts for help.
Professional ransomware chat companies handle communication with criminal groups on behalf of the victim. They know how ransomware gangs work, how to buy time, and how to pursue extortion demands. They can help handle the technical side of any payment if needed, and help the victim company check that the decryptors are actually working.
What victims may not expect is that their trusted negotiator may separately share details of the victim’s cyber insurance policy and strategies for negotiating directly with the attackers themselves.
That’s exactly what Florida man Angelo John Martino III did, and last week a federal judge sentenced him to 70 months in prison for it.
The 41-year-old Martino worked as a ransomware consultant for DigitalMint, a Chicago-based incident response company. His job was to negotiate on behalf of organizations that were held for ransom by ransomware attacks.
However, from April 2023, Martino began to lead a double life. Unknown to his employer or clients, Martino was providing information to the BlackCat group (also known as ALPHV) through a hidden tab within the same BlackCat chat panel he used for his official work.
In order to get a cut of the ransom payment, Martino feeds the criminals everything they want: the victims’ insurance limits, their internal negotiating positions, and their financial conditions.
At one point, Martino secretly warned the BlackCat company that the victim’s insurance company had authorized a limited payment.
In the official interview session – visible to both DigitalMint and the victim – he took the role of a concerned mediator with aplomb. However, behind the scenes, the gang knew exactly what to pull off.
The BlackCat operator’s response to the official interview was clear: “We know how much you can pay. Contact your insurance. We know about them too.”
The victim of the ransomware, a hospitality company, eventually paid about US $16.5 million.
In total, Martino’s five clients collectively made more than US $75.3 million in ransom payments between April and September 2023. This included a non-profit organization that paid nearly $26.8 million, and a financial services company that paid nearly $25.7 million — each payment likely to increase due to information Martino shared with the pirates.
But that wasn’t the end of Martino’s misdeeds, because he and two colleagues (Kevin Martin, another DigitalMint interviewer, and Ryan Goldberg, an incident manager at the cybersecurity company Sygnia) sent BlackCat ransomware against multiple victims themselves.
The trio kept 80% of the ransom and paid 20% to the BlackCat gang, as their affiliates – successfully defrauding a medical device company of US $1.2 million.
In April 2026, Goldberg and Martin were both sentenced to four years in prison.
Martino used the cryptocurrency for his criminal activity on two properties in Florida, a boat, and several vehicles. Authorities say they have seized US$10 million of his assets, and a hearing in September will determine how much more he will return.
“Angelo Martino sold out the victims he was hired to represent, offered BlackCat actors their secret negotiating positions in exchange for ransom and enrichment,” said Assistant Director Brett Leatherman of the FBI Cyber Division. “[The] The sentence indicates that the FBI will not only go after the criminals who send the ransomware, but also the insiders who enable them. Working with our partners, the FBI will find those who betray that trust and hold them accountable. “
US authorities described DigitalMint as an “unknown victim,” and said Martino deliberately hid what he was doing from his employer. The company has since changed the way negotiators interact with ransomware gangs, and is working with the Department of Homeland Security to establish a registry for the currently largely unregulated global ransomware network.
