The U.S. Department of Justice (DOJ) has sentenced two American cybersecurity professionals to prison for their involvement in ALPHV BlackCat ransomware attacks that targeted multiple U.S. organizations in 2023.
The case highlights the growing threat of insider expertise being misused in ransomware-as-a-service (RaaS) operations.
Ryan Goldberg, 40, from Georgia, and Kevin Martin, 36, from Texas, were each sentenced to four years in federal prison. Both individuals pleaded guilty to conspiracy to obstruct commerce through extortion.
According to court documents, the pair collaborated with a third co-conspirator, Angelo Martino, 41, of Florida, to deploy ALPHV BlackCat ransomware against multiple victims between April and December 2023.
The attackers operated as affiliates within the ALPHV BlackCat RaaS ecosystem, a model where core developers maintain the ransomware and infrastructure, while affiliates conduct intrusions and execute attacks.
DOJ Sentences Two Americans
In return, affiliates typically receive a large portion of ransom payments. In this case, Goldberg, Martin, and Martino agreed to give 20% of their earnings to ALPHV operators in exchange for access to the ransomware toolkit and extortion platform.
Investigators revealed that the trio successfully extorted approximately $1.2 million in Bitcoin from at least one victim. They retained 80% of the ransom, which they split evenly, and used various laundering techniques to conceal the proceeds.
Their attacks disrupted critical services, including medical and engineering organizations, and in at least one case led to the exposure of sensitive patient data.
What makes this case particularly concerning is that all three individuals worked in the cybersecurity industry.
They possessed advanced knowledge of defensive systems and security practices, which they exploited to carry out highly targeted attacks.
Authorities emphasized that this misuse of professional expertise significantly increased the impact and sophistication of the incidents.
ALPHV BlackCat, also known as BlackCat or Noberus, has been linked to over 1,000 victims globally. The group is known for its double-extortion tactics, where attackers not only encrypt systems but also exfiltrate sensitive data to pressure victims into paying ransoms.
ALPHV BlackCat Ransomware
The sentencing follows earlier law enforcement actions against the ransomware group. In December 2023, the FBI disrupted ALPHV infrastructure, seized associated websites, and developed a decryption tool that helped victims recover systems without paying. This effort reportedly saved organizations an estimated $99 million in ransom payments.
Goldberg and Martin pleaded guilty in December 2025, while Martino entered his guilty plea in April 2026.
Martino’s role extended beyond direct attacks he also acted as a ransomware negotiator and abused that position by sharing confidential victim data with threat actors to increase ransom demands. His sentencing is scheduled for July 9, 2026.
The FBI Miami Field Office led the investigation, with support from the U.S. Secret Service and international partners.
Notably, authorities tracked Goldberg across 10 countries as he attempted to evade arrest, demonstrating the global coordination involved in modern cybercrime enforcement.
The DOJ’s Computer Crime and Intellectual Property Section (CCIPS), which prosecuted the case, continues to play a central role in combating cybercrime.
Since 2020, CCIPS has secured over 180 convictions and facilitated the recovery of more than $350 million in stolen funds.
This case underscores a critical trend in the threat landscape: the weaponization of legitimate cybersecurity skills for criminal gain.
It also reinforces law enforcement’s message that ransomware actors regardless of their location or background will face prosecution and prison time.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
 has sentenced two American cybersecurity professionals to prison for their involvement in ALPHV BlackCat ransomware.){kind=link}