US Cybersecurity Experts Face Prison Time in Major Ransomware Conspiracy Case

May 3
2 min read

Key Findings

Two US cybersecurity professionals, Ryan Goldberg and Kevin Martin, sentenced to four years in prison for supporting BlackCat ransomware attacks
Both pleaded guilty to conspiracy and extortion charges related to attacks between April and December 2023
Third accomplice Angelo Martino pleaded guilty and awaits sentencing scheduled for July 9
The trio deployed ALPHV BlackCat ransomware against multiple US victims and extorted approximately $1.2 million in Bitcoin
Defendants had specialized cybersecurity expertise, making their involvement in cybercrime particularly egregious

Background

Ryan Goldberg, 40, of Georgia, and Kevin Martin, 36, of Texas, worked in the cybersecurity industry before turning to criminal activity. Goldberg was a former incident response manager at Sygnia, while Martin worked as a ransomware threat negotiator for DigitalMint. Both firms immediately distanced themselves from the defendants and cooperated fully with investigators. The third conspirator, Angelo Martino, 41, of Florida, also participated in the scheme.

The BlackCat Ransomware Operation

Between May and November 2023, the three men deployed ALPHV BlackCat ransomware against five US companies. They demanded ransom payments ranging from $300,000 to $10 million per target, including a medical device company, pharmaceutical firm, doctor's office, engineering company, and drone manufacturer. Only the medical device company paid, surrendering approximately $1.27 million in cryptocurrency after their systems were locked.

Money Laundering and Conspiracy

The defendants successfully extorted $1.2 million in Bitcoin from their victims. Goldberg personally handled money laundering operations, routing the cryptocurrency through mixers and digital wallets to obscure its origins and prevent law enforcement from tracking the funds. The proceeds were split among the three conspirators and shared with the BlackCat operators according to their ransomware-as-a-service agreement, which gave the attackers 20% of ransom payments.

Motivations and Arrest

Goldberg claimed financial desperation drove him to join the conspiracy, citing mounting debt. After learning that the FBI had raided one of his co-conspirators, he attempted to flee the country with his wife, eventually reaching Paris. Both Goldberg and Martin were indicted on October 2 for extortion and computer damage. Martin initially pleaded not guilty, while Goldberg confessed to FBI agents that an unnamed co-conspirator had recruited him to "ransom some companies."

ALPHV BlackCat Context

BlackCat operates using a ransomware-as-a-service model that has proven devastatingly effective. The malware developers and infrastructure maintainers remain separate from the affiliates who identify and target high-value victims. Court documents indicate the operation has compromised over 1,000 victims worldwide, with profits divided between the developers and attacking affiliates. The scheme continued until April 2025 before law enforcement dismantled this particular cell.

Sources

https://securityaffairs.com/191591/cyber-crime/two-us-cybersecurity-experts-sentenced-in-ransomware-case-third-awaits-july-ruling.html
https://x.com/shah_sheikh/status/2050607820102599086
https://x.com/TheCyberSecHub/status/2050607803476435451
https://x.com/cybernewslive/status/2050704179723665648
https://x.com/evanderburg/status/2050606893274632401