When federal prosecutors in the U.S. accused 3 cybersecurity experts of running a massive ransomware operation targeting American companies. This is a possible new trend: reputable professionals seemingly becoming cybercriminals. An indictment from October 2025 states that from May to November 2023, three United States citizens, Georgia’s Ryan Clifford Goldberg, Texas’s Kevin Tyler Martin, and a Florida unnamed co-conspirator, were working with the notorious ransomware group ALPHV/BlackCat, also called simply BlackCat, to breach corporate networks, steal data, and extort ransoms in cryptocurrency.
A shocking exploitation of trust for American companies
Goldberg’s head of incident response at Sygnia and Martin’s position as ransomware negotiation and incident response expert at Digitalmint, as well as the unnamed Florida co-conspirator to DigiMint. They were supposed to work as trusted cyber incident respondents to victims; however, they did the opposite.
Federal authorities allege the BlackCat/BlackCrypt ransomware operates the victim networks to the BlackCrypt and BlackCat networks to disguise their extortions and ransoms.
Goldberg’s admission to the Federal Bureau of Investigation that he joined the plan to relieve his debt was also a breach of trust.
Reported victims include a California engineering firm, a California doctor’s office, a Maryland pharmaceutical company, a Virginia drone manufacturer, and a Florida-based medical device company, which paid a ransom of $1.27 million (after a ransom demand of $10 million). The ransom demands for the Virginia drone manufacturer and the Maryland pharmaceutical company ranged from $300,000 to $5 million.
The legal response to a particularly dangerous incident
What makes these allegations particularly dangerous is the insiders’ access to high-level information. For instance, incident-response professionals have elevated privileges in client networks, deep knowledge of defensive systems, and forensic capabilities.
Prosecutors have stated that this case highlights the risk of insider threats, even from an organization that is countering cybercrime.
The defendants disclosed in court filings have been charged with conspiracy to interfere with interstate commerce by extortion, interference with commerce by extortion, and intent to damage protected computers. If the defendants are convicted, they each potentially could receive a 50-year sentence.
The National CIO Review – Sygnia and DigitalMint’s statements
Sygnia and DigitalMint’s statements both affirm that they are cooperating with investigators and that the named individuals are no longer employed. DigitalMint pointed out that the conduct under scrutiny happened outside their infrastructure and systems, and that the company is not a target of the investigation.
Assistant Attorney General Kenneth Polite Jr. of the Justice Department’s Criminal Division says:
“These individuals were supposed to protect organizations from cyber threats, not become the threat themselves.”
“Individuals, often at an information disadvantage, are the ones being exploited by other market participants.”
The wider implications:
This case is about the wrongdoing of a few individuals, and not the cyber-defense industry’s insufferable abuse. It highlights the unshakeable trust placed in incident-response and negotiation specialists, which makes this trust exploitation even riskier for the cyber-defense industry.
The importance and necessity of rigorous recruitment
An example of ALPHV/BlackCat shows how ransomware-as-a-service perpetrates ransomware attacks using cutting-edge tools and defers the risk of developing ransomware to the ransomware affiliate.
Expect scrutiny of the RaaS Model and the subsequent attacks launched by insiders, the laundering of ransom payments, the distribution of ransom payments, and the detection of additional unreported victims.
It’s likely that the lack of optionality from the perspective of this domain will result in more oversight and control of incident-response and ransom-relaxation-as-a-service.
This will, of course, serve as a wake-up call for organisations that are relying on external incident-response service providers. It is yet another reminder that trust in a vendor and access controls are crucial. The risk emanating from insiders can be as damaging as an external assault.
