Third US Security Expert Admits Helping Ransomware Gang

Why It Matters

The conviction highlights a critical insider threat vector that can amplify ransomware damage, prompting firms and regulators to reassess the oversight of third‑party negotiators and incident‑response providers.

Key Takeaways

• Angelo Martino, a ransomware negotiator, pleaded guilty in March 2026
• He provided BlackCat/Alphv with confidential negotiation data for a share
• DOJ seized $10 million in assets linked to Martino’s scheme
• The case marks the third insider aiding ransomware attacks in the U.S.
• Victims faced inflated ransums; BlackCat extracted $22 million before exit scam

Pulse Analysis

The emergence of insider‑assisted ransomware attacks marks a troubling evolution in cyber extortion. While incident‑response firms are hired to mediate with threat actors, the Martino case shows how privileged access can be weaponized. By leaking negotiation tactics and victim intelligence, insiders like Martino effectively become force multipliers for criminal groups, driving up ransom demands and eroding trust in third‑party negotiators. This breach of fiduciary duty not only inflates victim costs but also complicates law‑enforcement investigations, as the line between defender and perpetrator blurs.

BlackCat, also known as Alphv, leveraged the insider information to extract a $22 million payout before staging an exit scam in late 2023. The gang’s ability to sustain operations despite a 2023 disruption underscores the resilience of ransomware ecosystems when they tap into internal sources. The DOJ’s seizure of $10 million in assets signals a robust response, yet the pattern of insiders collaborating with ransomware operators suggests that financial incentives remain a powerful lure. As ransomware groups adapt, they increasingly seek collaborators within the very organizations tasked with mitigating attacks.

For cybersecurity firms, the fallout demands stricter governance and transparent protocols for handling ransom negotiations. Companies must implement segregation of duties, rigorous background checks, and continuous monitoring of negotiators’ communications. Policymakers are also likely to consider regulatory frameworks that hold third‑party responders accountable for conflicts of interest. Ultimately, curbing insider‑facilitated ransomware will require a blend of industry best practices, legal deterrents, and heightened awareness of the hidden risks embedded in the negotiation process.