Full Report
Angelo Martino helped accomplices extort a combined $75.3 million in ransom payments from five victim companies. The post Former DigitalMint ransomware negotiator pleads guilty to extortion scheme appeared first on CyberScoop.
Analysis Summary
# Incident Report: Insider Threat & Extortion via Third-Party Negotiator
## Executive Summary
Angelo Martino, a ransomware negotiator for the firm DigitalMint, conspired with BlackCat (ALPHV) ransomware affiliates to extort the very clients he was hired to protect. By sharing confidential insurance limits and internal negotiating positions, Martino enabled attackers to maximize ransom payments, resulting in $75.3 million in losses across five primary victims. Martino has pleaded guilty to conspiracy to deploy ransomware and commit extortion.
## Incident Details
- **Discovery Date:** April 2025 (Date DOJ informed DigitalMint)
- **Incident Date:** April 2023 – November 2023
- **Affected Organizations:** Multiple unnamed victims (including a nonprofit, hospitality group, financial services firm, retail, and medical company)
- **Sector:** Mixed (Nonprofit, Financial, Healthcare, Hospitality, Retail)
- **Geography:** United States
## Timeline of Events
### Initial Access
- **Date/Time:** April 2023
- **Vector:** Valid accounts / Insider access
- **Details:** Martino used his legitimate employment as a ransomware negotiator at DigitalMint to gain access to victim communications and sensitive financial data. Separately, Martino and co-conspirators (Kevin Martin and Ryan Goldberg) actively deployed ransomware against five additional companies.
### Lateral Movement
- **Information Flow:** Martino communicated via backchannels with BlackCat affiliates, providing them with real-time updates on what victims could afford to pay based on their insurance policies.
### Data Exfiltration/Impact
- **Financial Extortion:** $75.3 million total in ransom payments from five victims.
- **Specific Ransoms:** $26.8 million from a nonprofit; $25.7 million from a financial services company; $16.5 million from a hospitality company.
### Detection & Response
- **Detection:** Investigation by the Department of Justice.
- **Response Actions:** DigitalMint terminated Martino in April 2025 immediately after being notified of the investigation. Federal prosecution led to guilty pleas for Martino and his co-conspirators.
## Attack Methodology
- **Initial Access:** Abuse of trusted third-party relationship (DigitalMint) and insider access.
- **Persistence:** Legitimate employment and involvement in incident response (IR) cycles.
- **Defense Evasion:** Using official "negotiation" channels to mask collusion with threat actors; coordinated scripts with attackers to make threats appear more credible.
- **Discovery:** Accessing confidential insurance documents and internal corporate financial health markers.
- **Lateral Movement:** Not applicable in the traditional sense; used "Lateral Information Movement" between victim and attacker.
- **Impact:** Encryption of data (BlackCat/ALPHV) and high-value financial extortion.
## Impact Assessment
- **Financial:** Total documented loss of $75.3 million in ransom payments; additional costs related to decryption and recovery.
- **Data Breach:** Corporate financial data, insurance policy details, and potential PII/PHI from medical and retail victims.
- **Operational:** Significant disruption to business operations for the five primary victims and five additional targeted companies.
- **Reputational:** Massive breach of trust in the cyber insurance and incident response industry.
## Indicators of Compromise
- **Behavioral Indicators:**
- Negotiator recommending settlements that align suspiciously well with insurance policy caps.
- Threat actors referencing specific internal financial details (e.g., loan turnover rates) not typically available in public leaks.
- Coordination between "Incident Responders" (Sygnia/DigitalMint) and threat actor demands.
## Response Actions
- **Containment:** Removal of the insider threat from the organization (termination).
- **Eradication:** DOJ prosecution and sentencing of co-conspirators.
- **Recovery:** Victim organizations utilized decryptors provided after payment (under fraudulent negotiation pretenses).
## Lessons Learned
- **The "Negotiator Trap":** Third-party negotiators have access to the exact data (insurance limits) that threat actors need to maximize leverage.
- **Collusion Risks:** Vetting incident response partners is critical; "double-dipping" remains a significant risk in the unregulated ransomware negotiation market.
- **Transparency:** The lack of oversight in private ransomware negotiations allowed an insider to control both sides of the "conversation."
## Recommendations
- **Strict Access Control:** Limit a negotiator's access to full insurance policy documents until absolutely necessary; use "need-to-know" principles for financial reserves.
- **Independent Monitoring:** Have legal counsel or a secondary firm audit negotiation logs and tactics during an active incident.
- **Due Diligence:** Conduct deep background checks and continuous monitoring for employees in high-trust roles (negotiators, incident responders).
- **Multi-Party Verification:** Ensure all offers and counter-offers are reviewed by a committee (Legal, CFO, Board) rather than a single point of failure.