Two cybersecurity professionals have netted themselves four years in prison for carrying out ransomware attacks linked to ALPHV BlackCat, including extorting one victim for around $1.2 million in cryptocurrency.

Ryan Clifford Goldberg and Kevin Tyler Martin both held senior roles in the cybersecurity industry: Goldberg was an incident response supervisor at global cybersecurity firm Sygnia, while Martin served as a ransomware threat negotiator at Chicago-based fintech firm DigitalMint.

Together with their co-conspirator, Angelo Martino (who also had cybersecurity skills), they deployed ALPHV BlackCat ransomware between April 2023 and December 2023 against multiple US victims. The group agreed to give ALPHV BlackCat operators a 20% cut of any ransoms in exchange for access to the ransomware and its extortion platform.

After extorting a single victim for around $1.2 million in Bitcoin, the attackers split their 80% ransom share and laundered the proceeds.

Martino, who abused his role as a negotiator by sharing confidential victim information, is scheduled to be sentenced on July 9th.

“The court’s sentences today reflect the damage that these defendants inflicted during their cyberattacks on victim companies throughout the United States,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division.

“They harmed important firms who were providing medical and engineering services. They played hardball with them, going so far as to cause the leak of patient data from a doctor’s office victim. They also split the ransoms they were paid, and laundered the illicit proceeds.”

Back in December 2023, the FBI developed a decryption tool that could unlock infected systems to disrupt ALPHV BlackCat ransomware, saving victims approximately $99 million. The FBI also took down several websites operated by the criminals.

Court documents say that the group targeted over 1,000 victims globally.

---