A Florida ransomware negotiator who was supposed to reduce victims’ payouts was sentenced to 70 months in prison after prosecutors said he secretly helped BlackCat operators squeeze more money from the same clients.
Angelo Martino, 41, worked for DigitalMint, a Chicago company that negotiates cryptocurrency settlements for ransomware victims. According to a US sentencing memorandum, Martino’s job was to bargain with attackers on behalf of DigitalMint clients. Prosecutors said he instead passed confidential negotiating information to BlackCat actors in return for a cut of the payments.
The government said five DigitalMint clients paid more than $75 million to ransomware affiliates, including what prosecutors described as likely millions of dollars added because Martino disclosed information that victims had trusted him to protect.
Martino pleaded guilty to conspiracy to interfere with interstate commerce by extortion. He had asked the court for a 24-month sentence, citing cooperation that contributed to the prosecution of two co-defendants: Kevin Martin, another DigitalMint ransomware negotiator from Texas, and Ryan Goldberg, an incident manager at security firm Sygnia in Georgia. Martin and Goldberg were each sentenced in April to four years in prison, according to the Justice Department.
What prosecutors say he gave the attackers
Ransomware crews encrypt or steal data, then demand payment for decryption keys, nondisclosure, or both. BlackCat, also called ALPHV, operated through administrators and affiliates. Affiliates deployed the malware against victims and typically paid a share of the proceeds to the administrators, according to the government.
Prosecutors said Martino worked at DigitalMint from November 2022 to April 2025, first as an independent consultant and later as an employee. As part of that work, he received details about attacks, ransom demands, insurance coverage, and negotiation strategy, according to a factual proffer signed by Martino and prosecutors.
Beginning in April 2023, prosecutors said, Martino used Tox and a separate intermediary chat inside the BlackCat panel to communicate with the attackers. That channel was accessible only to Martino and BlackCat negotiators and affiliates, according to the factual proffer. Through it, prosecutors said, he disclosed victims’ insurance limits and internal bargaining positions so the attackers could demand more.
Victims in the scheme paid ransoms between $213,000 and $26.8 million from April 2023 through September 2023, according to the US. Prosecutors identified the affected organizations by sector, including hospitality, nonprofit, financial services, retail, and medical companies. The government said the attacks also disrupted services in sectors including finance and healthcare.
FBI Cyber Division Assistant Director Brett Leatherman said Martino “sold out” the victims he had been hired to represent by giving BlackCat actors their private negotiating positions.
Negotiators also became affiliates, prosecutors say
The government said Martino’s conduct went beyond leaking client information. In May 2023, prosecutors said, he obtained BlackCat affiliate access and shared it with Martin and Goldberg. The three then used the BlackCat platform to attack five additional victims, according to the factual proffer.
One of those attacks produced a $1.2 million payment from a medical device company, prosecutors said. The other victims did not pay, but the government said they suffered consequential losses from the attacks.
Martino received millions of dollars in cryptocurrency from the conspiracy, according to prosecutors. The FBI seized some cryptocurrency from him, but prosecutors said he had already spent much of the proceeds on two Florida houses, a boat, and several vehicles. As part of restitution efforts, Martino must forfeit property and pay 10 percent of any salary he earns after prison. Prosecutors are expected to submit a proposed forfeiture order next week.
DigitalMint said in a statement to Ars Technica that it did not know about Martino’s conduct while he worked there, fired the employees involved after learning of the allegations from the Justice Department, and cooperated with federal investigators. The company said Martino used unauthorized communication channels to evade its controls. Sygnia previously told CNN that it fired Goldberg immediately after learning of the case and was cooperating with the FBI.
This story draws on original reporting from Ars Technica.
