Ransomware negotiator hired to represent victims was working for the attackers
Ransomware negotiator hired to represent victims was working for the attackers
受聘代表受害者的勒索软件谈判专家竟是攻击者的同伙
A former ransomware negotiator was sentenced to 70 months in prison yesterday after colluding with BlackCat scammers to extort the victims he was hired to protect. 一名曾担任勒索软件谈判专家的男子昨日被判处 70 个月监禁，原因是他与 BlackCat 诈骗团伙勾结，勒索他本应保护的客户。
As a ransomware negotiator for the company DigitalMint, Florida resident Angelo Martino’s job was “to negotiate with cybercriminals to mitigate the ransoms paid by [DigitalMint’s] clients,” the US government said in a sentencing memorandum on Tuesday. 美国政府在周二的一份量刑备忘录中指出，佛罗里达州居民安杰洛·马蒂诺（Angelo Martino）曾是 DigitalMint 公司的勒索软件谈判专家，其职责是“与网络犯罪分子谈判，以减少 [DigitalMint] 客户支付的赎金”。
“Instead, Martino provided the cybercriminals with confidential negotiation information to maximize the ransoms in exchange for a portion of the ransom payments. Five of the victims whom Martino was supposed to help paid over $75 million to ransomware affiliates, including likely millions of dollars in ransom demands inflated as a result of the confidential information provided by Martino.” “然而，马蒂诺却向网络犯罪分子提供了机密的谈判信息，以最大化赎金金额，从而换取赎金分成。马蒂诺本应帮助的五名受害者向勒索软件关联方支付了超过 7500 万美元，其中包括因马蒂诺提供的机密信息而虚高出的数百万美元赎金。”
Martino, 41, pleaded guilty and asked for a 24-month sentence, noting that he “provided substantial assistance that contributed to the indictment and conviction of two co-defendants.” 41 岁的马蒂诺已认罪并请求判处 24 个月监禁，他表示自己“提供了实质性协助，促成了两名共同被告的起诉和定罪”。
As described in this November 2025 article, the co-defendants were Texas resident Kevin Martin, a ransomware negotiator for DigitalMint, and Georgia resident Ryan Goldberg, an incident manager at security firm Sygnia. Martino had not yet been named by authorities when charges against Martin and Goldberg were announced last year. Martin and Goldberg were each sentenced to four years in prison in April 2026. 正如 2025 年 11 月的一篇文章所述，这两名共同被告分别是 DigitalMint 的勒索软件谈判专家、德克萨斯州居民凯文·马丁（Kevin Martin），以及安全公司 Sygnia 的事件经理、佐治亚州居民瑞安·戈德堡（Ryan Goldberg）。去年当局宣布对马丁和戈德堡提出指控时，马蒂诺尚未被点名。马丁和戈德堡已于 2026 年 4 月分别被判处四年监禁。
To compensate victims, Martino must forfeit property and pay 10 percent of any salary he earns after release. The government is due to submit a proposed order of forfeiture by next week. Martino received millions of dollars in cryptocurrency as proceeds from the conspiracy, according to a factual proffer signed by Martino and US prosecutors. The FBI seized cryptocurrency from Martino, though he had already used much of it to buy two houses in Florida, a boat, and several vehicles. 为了赔偿受害者，马蒂诺必须没收财产，并支付其获释后工资的 10%。政府预计将于下周提交没收令草案。根据马蒂诺与美国检察官签署的事实陈述书，马蒂诺从该阴谋中获得了数百万美元的加密货币收益。联邦调查局（FBI）已从马蒂诺处查获了部分加密货币，但他此前已将大部分资金用于在佛罗里达州购买两套房产、一艘船和几辆汽车。
“Sold out the very victims he was hired to represent” “出卖了他受聘代表的受害者”
Martino was charged in February with conspiracy to interfere with interstate commerce by extortion. He faced a maximum sentence of 20 years. The US said that sentencing guidelines based on Martino’s limited criminal history suggest a range of 70 to 87 months, and recommended “a sentence of at least the mid-point of this range.” 马蒂诺于 2 月被控串谋通过勒索干扰州际贸易，最高面临 20 年监禁。美国政府表示，根据马蒂诺有限的犯罪记录，量刑指南建议的刑期范围为 70 至 87 个月，并建议“判处至少处于该范围中值的刑期”。
Victims of the scheme paid ransoms ranging from $213,000 to $26.8 million between April 2023 and September 2023. Besides the financial loss, the conspiracy “affected the ability of victims including companies in the financial services and health industry to provide services to customers,” the US said. Victims included a hospitality company, a nonprofit, a financial services company, a retail company, and a medical company, all of which had hired DigitalMint. 在 2023 年 4 月至 2023 年 9 月期间，该计划的受害者支付的赎金从 21.3 万美元到 2680 万美元不等。美国政府称，除了经济损失外，该阴谋还“影响了包括金融服务和医疗行业公司在内的受害者向客户提供服务的能力”。受害者包括一家酒店公司、一家非营利组织、一家金融服务公司、一家零售公司和一家医疗公司，它们都曾聘请过 DigitalMint。
“Angelo Martino sold out the very victims he was hired to represent, handing their confidential negotiating positions to BlackCat actors to drive up ransoms and enrich himself,” FBI Cyber Division Assistant Director Brett Leatherman said yesterday. FBI 网络部门助理局长布雷特·莱瑟曼（Brett Leatherman）昨日表示：“安杰洛·马蒂诺出卖了他受聘代表的受害者，将他们的机密谈判立场交给 BlackCat 成员，以抬高赎金并中饱私囊。”
Ransomware encrypts and steals data from computer networks in order to extort ransom payments. BlackCat, also known as ALPHV, caused chaos in the healthcare system by taking down the Change Healthcare payment network in February 2024 and was used against hundreds of other victims. The FBI said in December 2023 that it developed a decryption tool that gave victims the ability to restore their systems and seized several websites used by the ransomware group. 勒索软件通过加密和窃取计算机网络数据来勒索赎金。BlackCat（又称 ALPHV）曾于 2024 年 2 月瘫痪了 Change Healthcare 支付网络，导致医疗系统陷入混乱，并被用于攻击数百名其他受害者。FBI 在 2023 年 12 月表示，他们开发了一种解密工具，使受害者能够恢复系统，并查封了该勒索软件组织使用的多个网站。
BlackCat administrators granted access to “affiliates,” who deployed the ransomware against victims and typically gave 20 percent of the proceeds to the BlackCat administrators. The government is still offering rewards of up to $10 million for information on BlackCat administrators and affiliates. BlackCat 管理员向“关联方”授予访问权限，由后者对受害者部署勒索软件，并通常将收益的 20% 上交给 BlackCat 管理员。政府目前仍悬赏最高 1000 万美元，以征集有关 BlackCat 管理员和关联方的信息。
Martino and co-conspirators, in addition to working against their own clients’ interests, deployed the BlackCat ransomware themselves against five other victims, according to the US government. “Martino further used his knowledge of ransomware and connections with ransomware actors to secure an affiliate account for himself, Martin, and Goldberg with ALPHV BlackCat,” the US said. “As an ALPHV BlackCat affiliate, the three men deployed ransomware against five victims, successfully extorting one payment for $1.2 million [from a medical device company]. Although the other victims did not pay the ransom demand, they nevertheless suffered consequential losses from the attacks.” 据美国政府称，马蒂诺及其同谋不仅损害了自身客户的利益，还亲自对另外五名受害者部署了 BlackCat 勒索软件。美国政府表示：“马蒂诺还利用其对勒索软件的了解以及与勒索软件参与者的联系，为自己、马丁和戈德堡在 ALPHV BlackCat 申请了一个关联账户。作为 ALPHV BlackCat 的关联方，这三人对五名受害者部署了勒索软件，并成功勒索了一笔 120 万美元的款项（来自一家医疗设备公司）。尽管其他受害者没有支付赎金，但他们仍因攻击遭受了严重的后续损失。”
Chats with BlackCat attackers 与 BlackCat 攻击者的聊天记录
Martino worked at DigitalMint from November 2022 to April 2025, first as an independent cybersecurity consultant and later as a full-time employee. DigitalMint is based in Chicago, and Martino worked remotely on a company-issued laptop. 马蒂诺于 2022 年 11 月至 2025 年 4 月在 DigitalMint 工作，起初担任独立网络安全顾问，后来成为全职员工。DigitalMint 总部位于芝加哥，马蒂诺通过公司配发的笔记本电脑远程办公。
“As part of his duties, the defendant was provided with details regarding the attack and information regarding the ransom demand and typically the victim’s applicable insurance coverage and negotiating strategy,” the factual proffer said. 事实陈述书称：“作为职责的一部分，被告会获得有关攻击的详细信息、赎金要求信息，以及受害者适用的保险范围和谈判策略。”
Martino used BlackCat’s live chat system to negotiate ransom payments. Starting in April 2023, he “began communicating with BlackCat actors through the messaging platform Tox and in a separate ‘intermediary chat’ tab of the BlackCat panel,” which “was only accessible to the defendant and the BlackCat negotiators and affiliates,” the factual proffer said. 马蒂诺使用 BlackCat 的实时聊天系统来协商赎金支付。事实陈述书称，从 2023 年 4 月开始，他“开始通过 Tox 消息平台以及 BlackCat 面板中一个独立的‘中介聊天’标签与 BlackCat 成员沟通”，该标签“仅供被告以及 BlackCat 的谈判人员和关联方访问”。
Martino used the intermediary chat tab to provide confidential information about clients. “The purpose of these intermediary chat communications was to maximize the ransom payments paid by those victims to the BlackCat actors,” the court document said. “This information provided by the defendant without the victims’ knowledge included the victims’ insurance policy limits and internal negotiation positions. In exchange for providing confidential information, the defendant received a portion of the ransomware payments in digital currency.” 马蒂诺利用中介聊天标签提供有关客户的机密信息。法庭文件称：“这些中介聊天沟通的目的是最大化受害者支付给 BlackCat 成员的赎金。被告在受害者不知情的情况下提供的这些信息，包括受害者的保险保单限额和内部谈判立场。作为提供机密信息的交换，被告以数字货币形式获得了部分赎金分成。”