Cybersecurity Insider Exposed as Ransomware Mastermind in $75M Extortion Scheme Federal prosecutors have unmasked a shocking cybersecurity betrayal: Angelo Martino, a 41-year-old employee of Chicago-based DigitalMint, allegedly orchestrated the very ransomware attacks he was hired to negotiate. Martino and two accomplices Kevin Tyler Martin (also of DigitalMint) and Ryan Clifford Goldberg (an incident response manager at Sygnia Cybersecurity) are accused of extorting over $75 million from at least four companies and a nonprofit between 2023 and 2025. The victims spanned hospitality, retail, medical, and financial services, with two ransoms exceeding $25 million each. Martino’s role as a ransom negotiator provided insider access, while Goldberg exploited network vulnerabilities and Kevin Martin executed the attacks, locking systems and exfiltrating data. The group used ALPHV BlackCat ransomware, a notorious strain linked to hundreds of global attacks, under an "affiliate" agreement that funneled a cut of profits back to its developers. Authorities seized Martino’s Florida properties, vehicles, and $9 million in cryptocurrency. A plea hearing is scheduled for June 13, while Goldberg and Kevin Martin who pleaded guilty in December face sentencing on April 30. All three have been terminated from their employers. DigitalMint’s CEO, Jonathan Solomon, confirmed the company was alerted by the Justice Department in April 2025 and fired Martino immediately. A review found no additional misconduct, and DigitalMint has since tightened internal controls. Meanwhile, cybersecurity firm TRM Labs reports a surge in ransomware attacks, attributing the rise to a growing pool of threat actors exploiting vulnerabilities for profit.

Two Cybersecurity Professionals Plead Guilty as BlackCat Ransomware Affiliates Two former cybersecurity professionals, Ryan Goldberg (40, Georgia) and Kevin Martin (36, Texas), have pleaded guilty to conspiring with a third, unnamed accomplice to deploy BlackCat (Alphv) ransomware against five U.S. companies, including three healthcare organizations. The attacks, conducted between April and December 2023, earned the group at least $1 million from a single victim—a Florida-based medical device manufacturer. Goldberg, an incident response manager at Sygnia, and Martin, a ransomware negotiator at DigitalMint, exploited their industry expertise to facilitate the extortion scheme. As BlackCat affiliates, they received 80% of ransom payments, with the remaining 20% going to the ransomware-as-a-service (RaaS) operators. The proceeds were laundered through cryptocurrency mixing services and multiple wallets. Both men pleaded guilty on December 18 in the U.S. District Court for the Southern District of Florida to conspiracy to commit extortion, facing up to 20 years in prison, three years of supervised release, and a $250,000 fine. They also agreed to forfeit $324,123.26 each in illicit gains. Sentencing is scheduled for March 12, 2026. The FBI revealed that Goldberg admitted in a June 2024 interview to being recruited for the scheme, which targeted the medical device firm. Days later, Goldberg and his wife fled to Paris on one-way tickets, though he returned to the U.S. by October for his arraignment. Martin was released on a $400,000 bond. BlackCat, a Russian-linked RaaS operation active since 2021, has extorted hundreds of millions from over 500 victims worldwide. The FBI released a decryption tool in December 2023 to help some victims recover data. The group’s operations collapsed in early 2024 after its administrators allegedly stole a $22 million ransom from UnitedHealth Group’s Change Healthcare breach, betraying their affiliate. Both DigitalMint and Sygnia condemned the defendants’ actions, stating they were unaware of their employees’ criminal activities. DigitalMint cooperated with the DOJ investigation, while Sygnia terminated Goldberg upon learning of the charges.

Cybersecurity Insider Betrays Employer to Aid Ransomware Attacks, DOJ Reveals A former employee of Chicago-based cybersecurity firm DigitalMint has been exposed as a key conspirator in a ransomware scheme that targeted U.S. organizations between April and November 2023. According to the U.S. Department of Justice (DOJ), James Martino who was trusted to assist ransomware victims instead colluded with cybercriminals, sharing sensitive details such as insurance policy limits and negotiation strategies in exchange for a share of the profits. Martino worked alongside Ryan Goldberg (a Georgia resident employed by cybersecurity firm Sygnia) and Kevin Martin (a Texas resident and fellow DigitalMint employee) to deploy BlackCat ransomware against multiple victims. In one case, the group extorted $1.2 million in Bitcoin from a victim, splitting and laundering the proceeds through various channels. Authorities have since seized $10 million in assets linked to Martino, including digital currency, a food truck, and a luxury fishing boat. The DOJ emphasized that Martino’s actions not only harmed victims but also undermined the integrity of the cyber incident response industry. Goldberg and Kevin Martin were indicted in November 2025, with Martino initially identified as an unnamed co-conspirator. The case highlights the risks posed by insider threats within cybersecurity firms, where trusted personnel may exploit their access to facilitate criminal activity.

Velvet Ant: A Decade-Long Cyber Espionage Campaign Targeting Critical Infrastructure A sophisticated cyber espionage campaign linked to the China-nexus threat actor Velvet Ant has been uncovered, revealing nearly a decade of undetected infiltration into highly segregated critical infrastructure networks. The operation, detailed in Sygnia’s Operation Highland investigation, demonstrates a multi-stage attack chain designed to compromise authentication systems, ensuring persistence despite routine security measures. ### Attack Overview Velvet Ant’s primary objective was to control authentication mechanisms across targeted environments, allowing the group to maintain access even after password rotations, session terminations, or containment efforts. The campaign, active as early as 2016, employed deeply engineered backdoors in core system components, including modified OpenSSH binaries and tampered PAM modules, to exfiltrate credentials, log commands, and conceal malicious activity. ### Intrusion Phases The attack unfolded in three distinct stages: 1. Initial Foothold (Internet-Facing Servers) - Attackers compromised internet-exposed systems using custom implants, including a reverse-shell tool (auditdb, based on GS-Netcat) and SOCKS5 proxies. - Persistence was achieved via systemd units or modified SysVinit scripts, disguised as legitimate services (e.g., a fake Chrome service). - Malware was engineered to evade detection in process lists. 2. Lateral Movement (Bridging Isolated Networks) - Compromised Nginx servers and a FastCGI wrapper were used to execute binaries remotely, enabling access to air-gapped IT-to-OT environments without direct internet connectivity. - Simple HTTP requests served as an execution pathway into segregated networks. 3. Full Authentication Control (Backdoored System Components) - OpenSSH binaries (sshd, ssh, scp, ssh-keygen) were replaced with malicious variants, allowing attackers to: - Accept hardcoded backdoor passwords. - Log interactive commands and authentication attempts in encrypted files (stored under `/usr/share/man9/ph/` with MD5-hashed filenames). - Disable logging via a custom `-d` flag and masquerade processes as kernel threads. - PAM modules (pam_unix.so) were backdoored with nine distinct variants, each compiled in separate environments, some erasing traces of the backdoor in memory. - Older variants used rotating MD5-based backdoor hashes tied to days of the week, indicating iterative refinement. ### Impact & Risks The modifications transformed authentication from a security control into a covert persistence mechanism. Traditional remediation such as rotating credentials or removing services became ineffective, as the compromised code itself validated access. Sygnia warns that incorrectly replacing PAM modules or OpenSSH binaries could lock administrators out of critical systems, risking outages in environments where zero-downtime and offline recovery are essential. The campaign highlights the sustained investment and operational sophistication of Velvet Ant, with tailored implants across multiple Linux distributions and versions, demonstrating a structured build pipeline and long-term strategic targeting.