Former Ransomware Negotiator Pleads Guilty to BlackCat Attacks

Angelo Martino, a former employee of cybersecurity incident response company DigitalMint, has pleaded guilty to his involvement in BlackCat (ALPHV) ransomware attacks targeting U.S. companies in 2023. BleepingComputer reports that Martino, 41, leveraged his insider knowledge from the incident response world to facilitate these attacks.

This case is a stark reminder of the insider threat, especially from individuals with deep understanding of defensive playbooks and incident response strategies. Attackers don’t just operate from dark corners; sometimes, they’ve sat on the other side of the table. Martino’s actions underscore the critical need for robust vetting and continuous monitoring, even for trusted security professionals. The attacker’s calculus here was clear: exploit intimate knowledge of victim operations and response mechanisms to maximize impact and extortion potential.

For defenders, this means re-evaluating trust models, particularly around third-party vendors and former employees with privileged access or sensitive knowledge. The damage isn’t just financial; it erodes trust in the security ecosystem itself. This isn’t just about patching systems; it’s about patching people and processes.