Two Cybersecurity Workers Admit Guilt in Ransomware Scheme

Two ex-employees from cybersecurity firms, including a former ransomware negotiator, have admitted to orchestrating a series of ransomware attacks in 2023. The Department of Justice revealed their guilty pleas, stating that 40-year-old Ryan Goldberg and 36-year-old Kevin Martin extorted $1.2 million in Bitcoin from a medical device company and targeted several other organizations.

Goldberg, Martin, and an unnamed accomplice were indicted in October for their attacks, which involved the use of ALPHV / BlackCat ransomware to encrypt and steal sensitive data from their victims. Reports indicate that Martin and the third conspirator were ransomware negotiators at a cybercrime and incident response firm, while Goldberg held the position of incident response manager at another cybersecurity service.

ALPHV / BlackCat operates on a ransomware-as-a-service model, where the developers behind the malware take a share of the profits from the cybercriminals who deploy it against victims. In 2023, the FBI introduced a decryption tool aimed at helping victims recover data compromised by ALPHV / BlackCat, a group linked to notable attacks on companies such as Bandai Namco, MGM Resorts, Reddit, and UnitedHealth Group.

The DOJ’s indictment alleges that Goldberg, Martin, and their accomplice employed the ransomware to attempt to extort millions from various targets across the US, including a pharmaceutical company, a medical office, an engineering firm, and a drone manufacturer.

“These defendants leveraged their advanced cybersecurity skills to execute ransomware attacks — the very crimes they should have been working to prevent,” stated Assistant Attorney General A. Tysen Duva from the DOJ’s Criminal Division. “The Department of Justice is dedicated to utilizing all available resources to identify and apprehend those responsible for ransomware attacks within our jurisdiction.”

Goldberg and Martin have pleaded guilty to one count of “conspiracy to obstruct, delay, or affect commerce or the movement of any article or commodity in commerce by extortion.” Their sentencing is set for March 12, 2026, where they could face up to 20 years in prison.