What if the very person you hired for damage control actually made things worse? Unfortunately, that’s exactly what happened in a shocking case involving a trusted ransomware negotiator. Learn more about it here.
What Is a Ransomware Negotiator?
Ransomware is one of the most insidious threats in the modern cybersecurity landscape. Your computer systems and sensitive data get locked behind a digital fortress, with cybercriminals demanding an exorbitant payment for the key. To make matters worse, there’s no guarantee the attackers will restore everything even when you concede to their demands.
With the stakes this high, many companies might turn to ransomware negotiators for assistance. They’re specialized cybersecurity professionals who act as an intermediary between a victimized organization and cybercriminals. Their core responsibilities include:
- Delaying the attackers’ deadlines to allow internal forensic teams to investigate the breach and validate existing backups
- Demanding that attackers decrypt sample files or provide proof of a valid decryption key
- Using psychological insight and established negotiation strategies to lower the financial and operational impact for ransomware victims
- Coordinating with legal teams and law enforcement to navigate complex reporting obligations and regulatory risks
The Double Agent Dilemma in Ransomware Negotiations
Unfortunately, not all ransomware negotiators operate with integrity. In November 2025, the U.S. Department of Justice unsealed indictments revealing that three trusted cybersecurity professionals were secretly working with BlackCat (ALPHV), a notorious ransomware collective. These insiders abused their positions to hack organizations, deploy ALPHV/BlackCat ransomware, and extort their own clients.
Two of these “cybersecurity specialists,” Ryan Clifford Goldberg and Kevin Tyler Martin, both pleaded guilty to extortion conspiracy in December 2025 and were sentenced to four years in prison in April 2026. The third, Angelo Martino, received his federal prison sentence in July 2026. He will spend the next 70 months in prison, lose all assets connected to his crimes, and pay 10% of his future income as restitution to his victims.
Insights From Martino’s Employer
DigitalScoop identified Martino’s employer as DigitalMint, a U.S.-based cyber incident response company. According to a spokesperson, Martino and his co-conspirators operated independently and used unauthorized side channels to work with BlackCat.
DigitalMint also stressed that it maintained industry-standard controls and conducted background checks during the hiring process. The company terminated Martino and revoked system access after learning of the Justice Department’s investigation.
Building a Ransomware-Resilient Organization
Skilled negotiators may help recover encrypted files or reduce ransom demands, but the lack of strict regulation leaves room for questionable practices and even collaboration with cyber extortion groups. Err on the side of caution and consider proactive steps to prevent ransomware attacks, including:
- Implementing robust endpoint protection solutions
- Regularly backing up critical data and keeping offline copies
- Conducting frequent employee cybersecurity training sessions
- Using multi-factor authentication (MFA) across all systems
- Monitoring networks for unusual activity to detect a data breach early
When cybersecurity measures fail, and the worst-case scenario occurs, businesses with a robust incident response plan can act swiftly to minimize damage. The risk of insider betrayal is real, so vet every ransomware negotiator carefully if you decide to go that route.
