Cybersecurity professionals sentenced to four years for involvement in BlackCat ransomware campaign
The U.S. Department of Justice announced that two men who worked in the cybersecurity field have each received four-year prison terms for their participation in BlackCat ransomware operations that took place in 2023.
Federal authorities identified the sentenced individuals as Ryan Goldberg, 40, of Georgia, and Kevin Martin, 36, of Texas. Prosecutors say the pair were involved in deploying the ALPHV/BlackCat ransomware against multiple U.S. targets between April and December 2023. Both defendants entered guilty pleas in December 2025 and were accused of collaborating with a third co-conspirator, Angelo Martino, 41, of Florida.
According to the DoJ, the three agreed to remit 20% of any ransom payments to the ALPHV/BlackCat operators in return for access to the ransomware and the group’s extortion platform. The remaining 80% of any recovery was to be divided among the conspirators.
Investigators noted that all three men held positions in the cybersecurity sector - meaning they possessed expertise in protecting networks and systems, yet allegedly used those skills to carry out the attacks instead of preventing them. In one documented incident, the defendants successfully extorted roughly $1.2 million in Bitcoin from a victim, split their 80% share three ways, and then laundered the proceeds in an effort to hide the trail.
Although the ALPHV/BlackCat ransomware-as-a-service operation has since been dismantled, the group is believed to have targeted the networks of more than 1,000 victims worldwide during its run.
The sentencing follows a recent guilty plea from co-conspirator Angelo Martino, who admitted his role a week earlier and is slated to be sentenced in July 2026. Prosecutors say Martino exploited his position as a negotiator to secure larger payments by passing confidential information about victims’ insurance coverage limits to the BlackCat administrators.
Employment records indicate that Martino and Martin were affiliated with a company called DigitalMint, while Goldberg served as an incident response manager at cybersecurity firm Sygnia.
U.S. Attorney Jason A. Reding Quiñones for the Southern District of Florida emphasized that these defendants turned specialized defensive knowledge into a tool for extortion, using ransomware to disable vital systems, steal sensitive data, and coerce American businesses into paying to recover access to their information.