Two Cybersecurity Professionals Face Up to 20 Years in Prison After Pleading Guilty to Running BlackCat Ransomware Attacks
An incident response manager at Sygnia and a ransomware negotiator at DigitalMint admitted to moonlighting as ALPHV/BlackCat affiliates, targeting five US companies and causing over $9.5 million in losses.
Overview
Two cybersecurity professionals who used their industry expertise to conduct ransomware attacks against the very types of organizations they were hired to protect have pleaded guilty and face up to 20 years in federal prison. Ryan Clifford Goldberg, 40, of Georgia, and Kevin Tyler Martin, 36, of Texas, each admitted to one count of conspiracy to obstruct commerce by extortion for their roles as affiliates of the ALPHV/BlackCat ransomware operation, according to the Department of Justice.
The case is notable not only for its scale but for the defendants’ professional positions: Goldberg worked as an incident response manager at cybersecurity firm Sygnia, while Martin served as a ransomware negotiator at DigitalMint, a cyberthreat intelligence company, as reported by CyberScoop.
What We Know
Between April and December 2023, Goldberg, Martin, and an unnamed third co-conspirator deployed ALPHV/BlackCat ransomware against five U.S. companies: a Florida medical device manufacturer, a Maryland pharmaceutical company, a California doctor’s office, a California engineering firm, and a Virginia drone manufacturer, according to the DOJ announcement.
The trio operated as affiliates within the ALPHV/BlackCat ransomware-as-a-service ecosystem, paying the operation’s administrators a 20 percent cut of any ransom proceeds in exchange for access to the malware and the group’s extortion platform, as detailed by CSO Online.
Of the five attacks, one was financially successful: the Florida medical device company paid approximately $1.2 million in Bitcoin, which the conspirators split three ways after remitting the 20 percent affiliate fee and laundered the proceeds through various channels, according to CyberScoop. Total losses across all five victims exceeded $9.5 million, according to the same report.
The unnamed third co-conspirator, who also worked at DigitalMint, held the ALPHV affiliate account through which the attacks were conducted, CyberScoop reported.
The Investigation
Goldberg was arrested on September 22 and Martin on October 14, according to CyberScoop. Both pleaded guilty on December 19, 2025 in the U.S. District Court for the Southern District of Florida.
In a detail that underscores the severity of the case, Goldberg and his wife purchased one-way flights to Paris just 10 days after an FBI interview, CyberScoop reported.
By entering guilty pleas on one of three original counts, the defendants reduced their maximum exposure from 50 years to 20 years in federal prison. Each was also ordered to forfeit $342,000 and faces up to $250,000 in fines plus restitution, per CyberScoop.
Industry Response
Assistant Attorney General Tysen Duva said the defendants “used their sophisticated cybersecurity training and experience to commit ransomware attacks — the very type of crime that they should have been working to stop,” according to the DOJ.
DigitalMint stated the conduct violated company values and occurred “without the knowledge, permission or involvement” of the organization, per CyberScoop. Sygnia did not respond to requests for comment.
What We Don’t Know
Sentencing was scheduled for March 12, 2026, but the actual sentences imposed have not yet been publicly reported. The identity and legal status of the third co-conspirator, who also worked at DigitalMint, remain undisclosed.
It is also unclear whether the defendants’ professional access to victim networks or threat intelligence directly facilitated any of the attacks, or whether their cybersecurity expertise was applied independently of their employer roles. The extent to which this case may prompt broader industry scrutiny of insider threat controls at cybersecurity firms remains to be seen.
Analysis
The Goldberg-Martin case represents a rare and deeply corrosive form of insider threat: security professionals who exploit the trust and technical access inherent in their roles to commit the crimes they are paid to prevent. While ransomware-as-a-service affiliates are commonly prosecuted, the defendants’ positions at firms like Sygnia and DigitalMint — companies whose reputations depend on client trust — add a dimension that the cybersecurity industry will be forced to reckon with.
The prosecution of domestic affiliates — rather than the foreign operators who typically run ransomware platforms — signals a broadening of federal strategy against the ransomware ecosystem. For an industry built on trust, the case is a stark reminder that insider threats can emerge from within the ranks of the defenders themselves.