The Double Agent: Former Ransomware Negotiator Accused of Collusion with BlackCat Ransomware Group

When a company is hit by ransomware, chaos begins immediately.

Systems stop working. Customer data may be exposed. Business operations freeze. Revenue is disrupted. The attackers demand payment in exchange for decrypting files or withholding stolen data.

In a very short period of time, the victim must decide what to do.

Call law enforcement.

Restore from backups.

Negotiate with the attackers.

Notify customers, regulators, shareholders and insurers.

Evaluate legal risk.

Protect evidence.

Keep the business alive.

At that moment, companies often turn to outside specialists.

Cyber incident responders.

Forensic investigators.

Ransomware negotiators.

These experts are supposed to stand between the victim and the criminals. They contact the attackers, buy time, test whether the attackers actually possess stolen data, assess whether decryption is possible, reduce ransom demands and help the company navigate legal and operational risk.

But what happens if the negotiator is secretly working for the attackers?

That is the question raised by a case announced by the U.S. Department of Justice.

Angelo Martino, a 41-year-old former ransomware negotiator from Land O’Lakes, Florida, was sentenced to 70 months in prison for conspiring with BlackCat, also known as ALPHV, to extort multiple victims. He was also involved with other former cybersecurity professionals in attacks against additional U.S. victims in 2023.

According to the Justice Department, Martino abused his position at a U.S.-based cyber incident response company beginning in April 2023. Instead of helping victims, he provided BlackCat actors with confidential information about victims’ negotiation strategies and positions.

That information could tell attackers how long a victim could hold out, how much it might be willing to pay, what insurance coverage existed and what internal constraints shaped its decisions.

For a ransomware group, that kind of intelligence is worth money.

For a victim, it is devastating.

The Martino case reveals a new face of ransomware crime. The threat is no longer only the hacker who breaks into the network, deploys malware and demands cryptocurrency.

It may also be the trusted expert hired to help.

The Victim’s Negotiation Strategy Became a Weapon

In ransomware negotiations, information is power.

Attackers want to know how desperate the victim is. They want to know whether backups exist, whether systems can be restored, whether cyber insurance is available, how sensitive the stolen data is, how much media exposure the company fears, what regulators may require and how much the board may authorize.

The victim, by contrast, needs to understand the attacker.

Did the group really steal the data?

Can it actually decrypt the files?

Has it honored payment promises in previous cases?

Is there room to negotiate?

Would payment violate sanctions or other legal restrictions?

The negotiator’s role is to protect the victim in this imbalance.

But in Martino’s case, prosecutors said the balance was reversed.

The Justice Department said Martino provided confidential negotiation information from client victims to BlackCat actors, helping them increase pressure and extract larger payments.

The harm was not merely that information leaked.

Victims share their most sensitive facts with negotiators.

Financial constraints.

Recovery capabilities.

Willingness to pay.

Internal approval processes.

Insurance limits.

Legal assessments.

Crisis strategy.

If that information reaches the attackers, the victim has effectively explained its own weaknesses to the criminals.

A ransomware negotiation is like a chess match.

It can only function if each side does not know the other’s full position.

If someone sitting next to the victim is quietly reading the victim’s moves to the attacker, negotiation becomes coercion.

The Accomplice Was Closer Than the Hacker

The Martino case did not end with leaked negotiation information.

According to the Justice Department, Martino also conspired with two other former cybersecurity professionals, Kevin Martin of Texas and Ryan Goldberg of Georgia, to deploy BlackCat ransomware against additional victims. Martin and Goldberg were sentenced earlier to 48 months in prison each.

The department said the conspirators attacked victims across the United States between April and November 2023. In one case, they extorted about $1.2 million in bitcoin from a victim, divided the proceeds and laundered the funds through multiple methods.

That changes the character of the case.

Martino was not merely accused of being an insider who passed information to criminals. Former cybersecurity professionals used their knowledge and experience to participate in the attacks themselves.

Cybersecurity experts understand the attacker’s methods.

They know vulnerabilities, intrusion paths, log analysis, ransomware deployment, negotiation structures and the internal decision-making patterns of victims.

When used defensively, that knowledge protects society.

When used offensively, it becomes more dangerous than the skill set of an ordinary criminal.

That is what makes the case so disturbing.

People who once understood the shield picked up the spear.

A Crisis of Trust in Cyber Incident Response

When ransomware hits, companies depend on outside experts.

Internal security teams are often overwhelmed. A major incident may require forensic firms, incident response companies, outside counsel, insurers, negotiators, crisis-communications advisers, cloud-security providers and law-enforcement coordination.

These actors may gain access to the victim’s most sensitive information.

That structure requires trust.

But the Martino case shows that trust alone is not enough.

Companies hiring outside responders must examine conflicts of interest, internal controls, access rights, recordkeeping, financial relationships, cryptocurrency handling and the communications channels used to contact attackers.

Ransomware negotiators necessarily communicate with criminals.

That contact can be a legitimate part of the job.

But it is also the exact point where corruption and collusion can occur.

If a negotiator communicates privately with attackers, receives separate compensation, shares the victim’s internal strategy or controls the negotiation channel alone, the victim may not know until it is too late.

The incident response market therefore needs stronger governance.

Negotiations should be recorded.

All attacker communications should be visible to the company, counsel and, when appropriate, law enforcement.

Negotiation authority and payment authority should be separated.

Documents containing the victim’s strategy should have strict access controls and audit logs.

No individual negotiator should exclusively control cryptocurrency wallets or attacker communication channels.

Many companies search for an incident response vendor only after an attack begins.

That is too late.

The real question must be answered in advance.

Who is our incident response partner?

What internal controls does that firm use?

What ethical standards govern its negotiators?

Who supervises communications with threat actors?

Who approves payment decisions?

How are the interests of insurers, law firms, forensic vendors and negotiators aligned?

Ransomware response is not only a technical problem.

It is a trust-supply-chain problem.

The Lesson of BlackCat

BlackCat, also known as ALPHV, became one of the most notorious names in the ransomware ecosystem.

It operated as a ransomware-as-a-service group, working with affiliates to encrypt victims’ systems and threaten data leaks. The group targeted businesses and institutions across sectors and countries.

In December 2023, the U.S. Justice Department announced a disruption operation against the BlackCat ransomware variant. The FBI developed a decryption tool and offered it to more than 500 victims around the world. The department said the tool helped victims avoid about $99 million in ransom payments. It also said the FBI seized several websites associated with the group.

But the Martino case shows why ransomware does not end when servers are seized or decryptors are released.

Ransomware is not only technical infrastructure.

It is an ecosystem.

Initial-access brokers.

Malware developers.

Affiliate operators.

Negotiators.

Cryptocurrency launderers.

Leak-site administrators.

Insiders.

Former security professionals.

Gaps in insurance and negotiation markets.

Law enforcement may seize one server. Criminals may reappear under another name. A decryptor may help current victims. Criminals may develop a new variant.

But the flow of victim information from trusted responders to criminals requires a different form of control.

Ransomware defense is no longer only about blocking attackers.

It is about verifying the entire ecosystem that surrounds the victim after the attack.

Korean Companies Should Pay Attention

This is not only an American problem.

Korean companies are also exposed to ransomware risk.

Manufacturers, hospitals, universities, logistics companies, financial institutions, public agencies and small businesses all face attacks. Smart factories, cloud migration, remote work and connected supply chains have expanded the attack surface.

When an incident occurs, Korean companies also rely on outside specialists.

Forensic firms.

Security monitoring providers.

Law firms.

Insurers.

Negotiation advisers.

Cloud-security companies.

During that process, the victim’s internal information leaves the company.

Korean companies should not treat the Martino case as an unusual foreign incident.

They should treat it as a warning.

Ransomware response contracts should include at least five safeguards.

First, conflict-of-interest prevention.

The negotiator and incident response vendor should certify that they have no private contact, financial relationship or undisclosed connection with attackers.

Second, communication preservation.

Every conversation with the attacker, every offer, every price change and every payment condition should be recorded in a system accessible to the company and legal counsel.

Third, separation of authority.

Negotiation, payment approval, cryptocurrency transfer, forensic judgment and legal judgment should not be controlled by one person or one vendor.

Fourth, internal-control review of external vendors.

Companies should verify how incident response firms manage employee access, customer information, logs, ethics rules and communications channels.

Fifth, law-enforcement coordination.

Ransomware is not merely a commercial dispute. It is a crime. Even if a company considers negotiation, it should preserve the option to cooperate with law enforcement.

Companies should not prepare only backups and detection systems.

They must prepare criteria for who they will trust after an attack.

The Gray Zone of Insurance and Negotiation

The ransomware market has long contained an uncomfortable gray zone.

Victims want to recover quickly.

Insurers want to reduce losses.

Negotiators seek to lower the ransom.

Attackers want to know how much the victim can pay.

That structure can create dangerous incentives.

Attackers may prefer insured targets. If they learn the policy limit, they can calibrate demands. If the negotiation process is opaque, the victim may not know whether it received the best possible outcome. Some negotiators may view a fast settlement as success, even if payment strengthens the criminal ecosystem.

The Martino case is an extreme example of how dangerous that gray zone can become.

The negotiator who should have represented the victim instead handed the victim’s cards to the attacker.

The attacker could demand more.

The negotiator could profit.

The victim was exposed twice.

The incident response industry will now face pressure to become more transparent.

DOJ’s Message: It Will Not Only Chase Hackers

The message from the Justice Department and the FBI is clear.

Law enforcement will pursue not only the hackers who deploy ransomware, but also insiders, facilitators and laundering networks that make the ecosystem profitable.

In Martino’s case, authorities seized more than $10 million in assets, including digital assets, vehicles, a food truck and a luxury fishing boat. A restitution hearing is scheduled for September 17.

This reflects a broader change in ransomware enforcement.

For years, many victims assumed that overseas ransomware actors were beyond reach. Recently, however, law-enforcement agencies have combined cryptocurrency tracing, infrastructure seizures, decryptor distribution, accomplice prosecutions, sanctions and reward programs.

Ransomware groups rely on anonymity and borders.

But money leaves trails.

So do collaborators.

The Martino case shows that those trails can lead not only to external hackers, but also to trusted insiders.

The People Who Help Victims Must Also Be Verified

The most important moments in ransomware response come immediately after the attack.

Who explains the situation?

Who talks to the attackers?

Who advises on ransom payment?

Who evaluates recovery?

Who knows the victim’s weaknesses?

If those people cannot be trusted, the victim is attacked twice.

The first attack happens when the hacker encrypts the system.

The second happens when the person invited to help betrays the victim’s trust.

The Martino case demands a new standard for ransomware defense.

Technical defense is not enough.

Backups are not enough.

Insurance is not enough.

Hiring a well-known incident response firm is not enough.

Companies must design a trust structure for the entire incident response ecosystem.

The weakest link in cybersecurity is not always outside the firewall.

Sometimes it is the expert who enters the crisis room after the breach.