Two U.S. cybersecurity professionals who were trained to defend computer systems were sentenced to four years in prison each after prosecutors said they used that expertise to help extort American companies through ALPHV BlackCat ransomware.
The Justice Department said Ryan Goldberg of Georgia and Kevin Martin of Texas took part in attacks carried out in 2023 against several U.S. victims, including businesses involved in medical and engineering services.
Both men had worked in cybersecurity, a detail federal officials viewed as central to the case because the defendants understood the damage their attacks could cause.
The Justice Department said the two defendants turned their cybersecurity expertise into an extortion tool, working through BlackCat’s affiliate model to attack U.S. victims while offering the ransomware group’s administrators a cut of every payment they collected.
According to court documents, one victim paid roughly $1.2 million in Bitcoin, after which prosecutors said Goldberg, Martin and co-defendant Angelo Martino divided their share of the ransom and moved the money through laundering channels.
A trusted role becomes part of the attack
Federal officials said the scheme was especially damaging because it involved professionals who had built careers around cyber defense. Assistant Attorney General A. Tysen Duva said the defendants targeted companies that provided important services and escalated pressure on victims, including through the leak of patient information from a doctor’s office.
“These were supposed to be cybersecurity specialists who did good and helped businesses and people,” Duva said. “Instead, they used their high-level cyber skills to feed their greed.”
Martino, who is due to be sentenced on July 9, played a separate role that prosecutors described as an abuse of trust. While working as a ransomware negotiator for victims, he shared confidential information with threat actors to push ransom demands higher.
FBI Tracks BlackCat Actors Beyond Borders
The sentences build on the government’s earlier move to disrupt BlackCat in December 2023, when the FBI seized parts of the group’s online infrastructure and released a decryption tool that helped hundreds of victims recover locked systems. Authorities said that effort prevented about $99 million in ransom payments.
FBI Cyber Division Assistant Director Brett Leatherman said the case showed that ransomware actors cannot count on borders or technical skill to shield them, noting that investigators tracked Goldberg across 10 countries after he tried to flee the United States.
“Ransomware criminals can operate anywhere, including right here in the United States,” Leatherman said, “and the FBI is actively working to track them down and dismantle their networks.”