Florida Ransomware Negotiator Convicted for Helping Ransomware Gang Extort U.S. Companies

In a case that exposes a dangerous breach of trust within the cybersecurity industry, a Florida man who worked as a professional ransomware negotiator has been sentenced to more than five years in federal prison for conspiring with cybercriminals to deploy and profit from ransomware attacks against American businesses.

The U.S. Department of Justice officially announced the sentence on Thursday, revealing that authorities also seized over $10 million in cryptocurrency and physical assets purchased by the defendant with proceeds from the hacks. Those assets include a custom‑built food truck, a luxury offshore fishing boat, multiple high‑end vehicles, and several investment properties, all traced back to illicit payments made by victim companies.

Inside the Scheme

The convicted man, Angelo Martino, is the third individual to be sentenced in this far‑reaching conspiracy. He follows two former colleagues, Kevin Martin and Ryan Goldberg, both previously employed in cybersecurity roles, who were jailed earlier this year for their involvement.

According to court documents and prosecutors, the trio operated a double life throughout 2023. During the day, they worked for a well‑known U.S. cybersecurity firm, advising companies on how to respond to ransomware incidents, negotiate lower payments, and recover their systems. Behind the scenes, however, they collaborated directly with the BlackCat ransomware gang, also known as ALPHV, to target the very same types of businesses they were hired to protect.

In one of the most clearly documented attacks, the group deployed BlackCat malware against a regional manufacturing firm in the Midwest. They encrypted the company’s entire network, threatened to leak sensitive employee and client data, and demanded a ransom of $1.2 million. Once the payment was made, the three men split the proceeds, then used complex money‑laundering techniques to convert the cryptocurrency into spendable funds and tangible assets.

“This case represents a profound betrayal of trust,” said the U.S. Attorney for the Southern District of Florida. “These individuals were paid to defend companies from cyber threats; instead, they helped the attackers strike and profited from the harm they caused.”

How BlackCat Operates

BlackCat is classified as a ransomware‑as‑a‑service (RaaS) operation, a business model that has become increasingly dominant in cybercrime. The group develops and maintains the sophisticated encryption tools, then rents access to independent hackers called “affiliates” who identify targets, deploy the malware, and negotiate ransoms. In return, the operators of BlackCat take a percentage of every payment, while the affiliates keep the remainder.

The scheme involving Martino and his associates was particularly insidious because they brought insider knowledge: they understood how companies typically respond, what insurance policies would cover, and how to navigate the negotiation process to maximize the payout. This gave them an advantage over ordinary attackers, allowing them to pressure victims more effectively and avoid detection for longer.

BlackCat gained widespread infamy in early 2024 when it was linked to the massive breach of Change Healthcare, one of the largest health technology providers in the United States. That attack exposed the medical records, billing details, and personal information of more than 192 million people, making it one of the largest healthcare data breaches in history. Though the specific affiliates behind that incident have not yet been identified, the gang’s infrastructure and tactics remain under constant investigation by law enforcement agencies worldwide.

Implications for Cybersecurity and Business

The conviction shines a light on the complex and often controversial ecosystem that has grown around ransomware attacks. As threats have risen, so has the industry built to respond: today, ransomware incidents have spawned a specialized sector of cyber insurance, response firms, and professional negotiators. These services aim to help companies restore operations quickly and minimize financial damage.

However, the case also highlights the risks inherent in this space. While law enforcement and government agencies universally advise victims not to pay ransoms, noting that payments only fund further criminal activity, many businesses still choose to negotiate and pay, fearing permanent data loss, operational shutdowns, or damage to their reputation.

“Victims are often caught between two difficult choices,” explained a senior FBI cyber division official. “Paying the ransom does not guarantee your data will be restored or kept private, but refusing can mean weeks or months of downtime. This case shows that the risk doesn’t just come from hackers outside the company; it can also come from those claiming to offer solutions.”

Strengthening Defenses

In the wake of this conviction, cybersecurity regulators and industry associations are reviewing stricter oversight requirements for firms offering incident response and negotiation services. Proposed measures include mandatory background checks, independent audits of negotiation processes, and rules to prevent employees from having undisclosed financial links to cryptocurrency or criminal groups.

For companies, the lesson is clear: while external support is often necessary, it is equally important to verify credentials, establish clear protocols, and work only with providers that follow strict ethical and legal guidelines.

As for Martino, Martin, and Goldberg, their sentences send a strong message: anyone who uses their technical knowledge and access to aid cybercriminals will face severe consequences, regardless of their professional title or industry standing.