Two former employees from cybersecurity firms—one of whom negotiated ransomware deals—have admitted guilt in a series of ransomware attacks that took place in 2023. The Department of Justice announced their guilty pleas on Tuesday, revealing that 40-year-old Ryan Goldberg and 36-year-old Kevin Martin extorted $1.2 million in Bitcoin from a medical device company and attempted to target several others.
Goldberg, Martin, and an unnamed co-conspirator were indicted in October for their roles in these attacks, which involved utilizing ALPHV / BlackCat ransomware to encrypt and steal data from their victims. According to the Chicago Sun-Times, Martin and the third co-conspirator worked as ransomware negotiators at Digital Mint, a company focused on cybercrime and incident response, while Goldberg served as an incident response manager at Sygnia Cybersecurity Services.
ALPHV / BlackCat is a hacker group that employs a ransomware-as-a-service model, where developers maintain the malware and take a portion of the stolen funds from the criminals who deploy it against victims. In 2023, the FBI created a decryption tool aimed at helping victims recover data affected by ALPHV / BlackCat, which has been responsible for major attacks on firms such as Bandai Namco, MGM Resorts, Reddit, and UnitedHealth Group.
The DOJ’s indictment claims that Goldberg, Martin, and their co-conspirator used ransomware to try to extort millions from various victims across the U.S., including a pharmaceutical company, a doctor’s office, an engineering firm, and a drone manufacturer.
“These defendants used their advanced cybersecurity training and experience to carry out ransomware attacks—the very crimes they should have been helping to prevent,” stated Assistant Attorney General A. Tysen Duva of the DOJ’s Criminal Division. “The Department of Justice is dedicated to using all available tools to identify and apprehend those responsible for ransomware attacks wherever we have jurisdiction.”
Goldberg and Martin pleaded guilty to one count of “conspiracy to obstruct, delay, or affect commerce or the movement of any article or commodity in commerce by extortion.” Sentencing is set for March 12, 2026, where they could face up to 20 years in prison.
