- Trending
- Comments
- Latest
Two American cybersecurity professionals who specialized in fighting ransomware have been charged with secretly working for the ALPHV BlackCat Hacker Group (ransomware gang), using their insider expertise to help extort at least $1.3 million from US companies, federal prosecutors announced Monday.
Ryan Clifford Goldberg, 34, a former director of incident response at Israeli cybersecurity firm Sygnia, and Kevin Tyler Martin, a ransomware negotiator at crypto payments platform DigitalMint, allegedly exploited their privileged access to corporate networks and ransom negotiations to orchestrate attacks on healthcare, pharmaceutical, and defense contractors between May 2023 and early 2024, according to a Department of Justice indictment.
Prosecutors claim the trio launched attacks on at least five U.S. companies, including a medical device manufacturer in Florida, a pharmaceutical company in Maryland, a Virginia drone maker, and two California-based businesses. In one instance, the group reportedly secured $1.3 million in ransom payments from a Tampa-based medical firm, later sharing proceeds with ALPHV ransomware developers.
“The ALPHV BlackCat hacker group has demonstrated an alarming capacity to exploit industry insiders,” said Lisa Monaco, U.S. Deputy Attorney General. “This case highlights the evolving nature of ransomware threats where even trusted cybersecurity experts can become bad actors.”
Court documents reveal that Goldberg was the Director of Incident Response at Israel-based Sygnia Consulting Ltd., while Martin served as a ransomware negotiator at Chicago-based DigitalMint, a crypto payments platform. Both roles gave them unparalleled access to sensitive data and ransomware negotiation tactics—knowledge that prosecutors allege was weaponized for personal profit.
The ALPHV BlackCat hacker group has long been notorious for operating under a “ransomware-as-a-service” (RaaS) model, allowing affiliates to rent their malicious tools in exchange for profit shares. This structure made it easy for experienced insiders like Goldberg and Martin to integrate into the scheme undetected.
Federal investigators stated that Goldberg’s expertise in ransomware response provided him with a deep understanding of how victims typically recover and pay ransoms. Meanwhile, Martin’s experience at DigitalMint enabled him to liaise directly with ransomware victims, often managing cryptocurrency transfers—skills prosecutors say were later used for their illicit campaign.
“Insider threats remain one of the hardest challenges to mitigate,” cybersecurity analyst Allan Liska told The Record by Recorded Future. “The ALPHV BlackCat hacker group case underscores that even the gatekeepers of our digital defenses can be compromised.”
Both Sygnia Consulting and DigitalMint swiftly confirmed that their former employees were implicated but denied any involvement in criminal activity.
In a public statement, Marc Jason Grens, President of DigitalMint, clarified:
“Martin’s actions were completely outside the scope of his employment. DigitalMint is cooperating fully with authorities, and no client data was accessed or compromised.”
Sygnia also emphasized that Goldberg was terminated immediately following the allegations and that the company is working closely with investigators.
The ALPHV BlackCat hacker group, also known as BlackCat, has been linked to over 200 global ransomware incidents, including the devastating Change Healthcare breach in 2024, which compromised data from 190 million Americans and led to a $22 million ransom payment.
U.S. prosecutors have intensified efforts to dismantle the ALPHV BlackCat hacker group, labeling it a “priority threat” due to its sophisticated encryption techniques and use of cryptocurrency laundering. The FBI has previously seized several ALPHV-linked servers and crypto wallets but acknowledges that new variants of the ransomware continue to emerge.
“The ALPHV BlackCat hacker group represents one of the most adaptive and persistent ransomware threats globally,” said Bryan Vorndran, Assistant Director of the FBI’s Cyber Division. “This case sends a clear message: insider collusion will not shield you from justice.”
Goldberg remains in federal custody in Florida. His attorney, MaeAnn Renee Dunker, declined to comment on whether her client plans to enter a plea. Martin, meanwhile, is expected to face arraignment later this month.
As authorities continue to probe the ALPHV BlackCat hacker group, cybersecurity experts are calling for stronger vetting and oversight within the private sector. The case has reignited debate over whether cybersecurity certifications and background checks are sufficient to detect potential insider threats.
“This scandal shakes the foundation of trust within cybersecurity circles,” said Troy Hunt, founder of Have I Been Pwned. “It’s a wake-up call for companies to look beyond credentials and evaluate integrity as a core security asset.”
With the ALPHV BlackCat hacker group still active across global networks, federal officials warn that the fight against ransomware is far from over — and that no one, not even cybersecurity professionals, is above scrutiny.
