On March 12, 2026, the U.S. Department of Justice unsealed charges against Angelo John Martino III, a former ransomware negotiator accused of “playing both sides” by conducting attacks and then negotiating on behalf of his victims.

Martino, a former employee of the cybersecurity firm DigitalMint, allegedly partnered with the ALPHV/BlackCat ransomware operation to extort approximately $75.25 million from at least 10 victims.

Key Details of the Charges

• The Scheme: Martino allegedly obtained an affiliate account with the BlackCat group and conspired with other cybersecurity professionals to breach networks, steal data, and deploy ransomware.
• Dual Role: In several cases, victims hired DigitalMint for incident response, and the firm unknowingly assigned Martino to lead negotiations—effectively negotiating with himself as the attacker.
• Accomplices: Martino was previously identified as “Co-Conspirator 1” in an October 2025 indictment that charged two other security professionals, Kevin Tyler Martin and Ryan Clifford Goldberg, both of whom have already pleaded guilty.
• Legal Status: Martino surrendered to U.S. Marshals on March 10, 2026, and faces one count of conspiracy to interfere with interstate commerce by extortion.

Professional Background of the Group

The defendants leveraged their high-level cybersecurity training and internal knowledge of how organizations respond to breaches to increase the effectiveness of their extortion.

• Angelo Martino: Former lead ransomware negotiator at DigitalMint.
• Kevin Martin: Former negotiator at DigitalMint.
• Ryan Goldberg: Former incident response manager at Sygnia.

DigitalMint and Sygnia have both stated that they cooperated with law enforcement and that the criminal activity occurred outside their corporate infrastructure.