Two former employees of cybersecurity firms – one of whom was a ransomware negotiator – have pleaded guilty to carrying out a series of ransomware attacks in 2023. The Justice Department announced the guilty plea Tuesday, saying Ryan Goldberg, 40, and Kevin Martin, 36, extorted $1.2 million in Bitcoin from a medical device company and targeted several others.
Goldberg, Martin and an unnamed co-conspirator were convicted in October of carrying out the attacks, which involved using ALPHV/BlackCat ransomware to encrypt and steal data from their victims. As reported Chicago Sun-TimesMartin and the third conspirator worked as ransomware negotiators at cybercrime and incident response company Digital Mint, while Goldberg was an incident response manager at Cygnia Cyber Security Services.
ALPHV/BlackCat is a hacker group that uses a ransomware-as-a-service model, with the developers maintaining the malware often taking a share of the money stolen from cybercriminals who use it to target victims. In 2023, the FBI developed a decryption tool designed to recover data from victims of ALPHV/BlackCat, which has been linked to high-profile attacks on companies such as Bandai Namco, MGM Resorts, Reddit, and UnitedHealth Group.
The DOJ’s indictment claims that Goldberg, Martin, and co-conspirators used ransomware in an effort to extort millions of dollars from victims across the United States, including a pharmaceutical company, a doctor’s office, an engineering company, and a drone manufacturer.
“These defendants used their sophisticated cybersecurity training and experience to carry out ransomware attacks – the very type of crime they were supposed to be working to prevent,” Assistant Attorney General A. Tyson Duva of the DOJ’s Criminal Division said in a statement. “The Department of Justice is committed to using all tools available to identify and arrest perpetrators of ransomware attacks wherever we have jurisdiction.”
Goldberg and Martin pleaded guilty to one count of “conspiracy to obstruct, delay, or effect the movement of any article or thing in commerce by extortion.” His sentencing is scheduled for March 12, 2026, where he faces up to 20 years in prison.
<a href