2 Cyber Pros Admit to Being BlackCat Ransomware Affiliates

Two cybersecurity professionals who moonlighted as BlackCat ransomware gang affiliates pleaded guilty to using the crypto-locking malware to extort victims in the United States.

See Also: Virtual Cloud Ransomware Tabletop: Unpacking an Attack from Detection to Recovery

Ryan Goldberg, 40, of Georgia, and Kevin Martin, 36, of Texas, admitted in Miami federal court to participating in a conspiracy to extort five U.S. companies, including three healthcare organizations. A third, unnamed co-conspirator who resides in Land O’Lakes, Florida, is also suspected of being involved in all of the attacks, according to court documents (see: 2 Ex-Cyber Specialists Indicted for Alleged BlackCat Attacks).

Prosecutors said all three individuals were employed at cybersecurity services firms while hacking for BlackCat. Martin and the unnamed co-conspirator were ransomware negotiators at DigitalMint, while Goldberg was employed as an incident response manager at Sygnia.

“These defendants used their sophisticated cybersecurity training and experience to commit ransomware attacks – the very type of crime that they should have been working to stop,” said Assistant Attorney General A. Tysen Duva, head of the Department of Justice Criminal Division.

Goldberg and Martin on Dec. 18 both entered guilty pleas in the U.S. District Court for the Southern District of Florida to count one of the indictment, a charge of conspiracy to obstruct, delay or affect commerce or the movement of any article or commodity in commerce by extortion.

The maximum sentence that can be imposed is 20 years’ imprisonment, three years of parole and a fine of up to $250,000 or twice the gross gain or loss of the offense. They also agreed to forfeit any property tied to proceeds from the offense, and to each pay a forfeiture monetary judgement of $324,123.26.

As part of the plea deal, the government agreed to dismiss counts two and three of the indictment at sentencing, respectively involving interference with commerce by extortion, and intentional damage to a protected computer.

The court accepted the guilty pleas on Monday. The two men are due to be sentenced on March 12, 2026.

“Ransomware is not just a foreign threat – it can come from inside our own borders,” said U.S. Attorney Jason A. Reding Quiñones for the Southern District of Florida, commenting on the Americans’ guilty pleas.

The indictment against Goldberg and Martin charged them with using the BlackCat – aka Alphv – ransomware against multiple targets from April 2023 through December 2023. “The three men agreed to pay the Alphv BlackCat administrators a 20% share of any ransoms received in exchange for access to the ransomware and Alphv BlackCat’s extortion platform,” the indictment said.

Prosecutors said the defendants would have been very familiar with the damage caused by their actions. “All three men worked in the cybersecurity industry – meaning that they had special skills and experience in securing computer systems against harm, including the type of harm they themselves were committing against the victims in this case,” the indictment said.

“After successfully extorting one victim for approximately $1.2 million in bitcoin, the men split their 80% share of this ransom three ways and laundered the funds through various means,” the indictment said, noting that the victim was a Florida-based medical device maker.

The FBI said that in a June 17 interview, Goldberg said he was recruited by one of the co-conspirators to “try and ransom some companies,” which led to the Florida medical device manufacturer paying a ransom, after which the defendants attempted to launder the proceeds by routing it through a mixing service and multiple wallets.

10 days after his interview, Goldberg and his wife flew from Atlanta to Paris on one-way tickets booked two days prior to travel. “The FBI is unaware of any flights purchased by Goldberg to return to the United States,” the bureau said in a Sept. 19 affidavit.

Goldberg was back in the United States by Oct. 7, when court records show both he and Martin were arraigned, with only Martin being released, on a $400,000 bond.

Both Goldberg and Martin’s former employers said they were unaware of the defendants’ activities.

“DigitalMint is aware of Kevin Tyler Martin’s guilty plea. We strongly condemn his actions, which were undertaken without the knowledge, permission or involvement of the company. His behavior is a clear violation of our values and ethical standard,” the cyberthreat intelligence firm DigitalMint told Information Security Media Group Tuesday in a statement.

The firm added: “We fully cooperated with the Department of Justice throughout its investigation and support this outcome as a critical step toward accountability.”

Cybersecurity firm Sygnia didn’t immediately respond to a request for comment, but told ISMG early last month, when the charges were first announced, that Goldberg was by then a former employee. “Immediately upon learning of the situation, he was terminated. While Sygnia is not a target of this investigation, we are continuing to work closely with the FBI,” it said at the time.

BlackCat Affiliates

Goldberg, Martin and their co-conspirator worked with the Russian-speaking BlackCat ransomware operation, which launched in 2021 and has ultimately amassed more than 500 victims around the world and earned hundreds of millions of dollars in ransoms, said the FBI.

The FBI released in December 2023 a decryption tool for victims of some BlackCat variants.

BlackCat’s operators developed the software and provided it to vetted affiliates in what’s known as a ransomware-as-a-service operation. Each affiliate gains access to a private, password-protected panel for downloading a fresh copy of the crypto-locking malware, which contains a unique affiliate ID code. Any time a victim pays a ransom, the agreement is that operators will keep their pre-agreed cut – 20% or 30% is the industry standard – and remit the rest of the cryptocurrency to the affiliate.

Not all ransomware-as-a-service administrators abide by such agreements. BlackCat came to an end after its operators apparently got greedy and ran an exit scam in early 2024 to keep the reportedly $22 million ransom paid by UnitedHealth Group over the Change Healthcare breach, rather than share it with the affiliate who conducted the attack.