Employee of Chicago cybersecurity firm brokered $75m in ransom payments after orchestrating hacks: feds

Cybersecurity expert Angelo Martino was a wolf in sheep’s clothing, prosecutors say.

Martino, a 41-year-old employee of Chicago cybersecurity company DigitalMint, negotiated on behalf of companies hit with multimillion-dollar ransom demands after their computers were hacked.

But he actually helped orchestrate the hacks at the center of those same ransom schemes, prosecutors say. Martino and his associates are accused of extorting more than $75 million in ransoms from four companies and a nonprofit organization that he represented as a negotiator.

The victims included hospitality, retail, medical and financial services businesses. Two of the ransom payoffs were for more than $25 million, according to court records.

The feds have seized Martino’s properties in Florida, his vehicles and more than $9 million in cryptocurrency. A hearing is scheduled Thursday for Martino to consider entering a guilty plea.

Martino conspired with Kevin Tyler Martin, another ransom threat negotiator for DigitalMint, and Ryan Clifford Goldberg, an incident response manager for Sygnia Cybersecurity Services, according to prosecutors

Goldberg’s role in the scheme was to identify computer weaknesses and gain access to victims’ networks. Martin’s job was to identify victims, extract data from their computers and lock their networks, prosecutors say.

In December, Goldberg and Martin pleaded guilty to extortion and are scheduled to be sentenced April 30. Martino was referred to as an unnamed co-conspirator in that case.

‘Ransomware’ called BlackCat

Prosecutors say the scheme began in 2023.

Goldberg told FBI agents he got involved to get out of debt, according to court records.

Martino and his associates instructed companies to pay ransoms in exchange for a key to unlock encrypted data they’d hacked — along with a promise not to publish the victims’ stolen data, prosecutors say.

Martino and his associates allegedly hacked into victims’ computer networks using software called ALPHV BlackCat, which has been used in hundreds of attacks around the world.

The developers of ALPHV BlackCat provided the crew with access to their ransomware under what’s called an “affiliate” agreement, in which a portion of proceeds from a ransom payment is kicked back to the developers, according to prosecutors.

Martino and Martin have both been fired by DigitalMint, and Goldberg no longer works for Sygnia.

In a statement, DigitalMint CEO Jonathan Solomon said the Justice Department informed the company of the allegations in April 2025, and Martino "was terminated the next day." Solomon said the company reviewed Martino's work and found "no evidence of other criminal conduct beyond what is reflected in the charging documents."

“DigitalMint has fully cooperated with law enforcement from the outset and does not expect further charges," he said. "While no organization can completely eliminate insider risk, we take incidents like this extremely seriously and have strengthened safeguards and internal controls to further reduce the likelihood of similar conduct.”

‘More bad guys out there’

According to TRM Labs — a company that helps financial institutions and government agencies like the FBI investigate cryptocurrency-related fraud — ransom attacks rose last year, along with the spread of various types of ransomware.

“There's just more people [and] more entities being victimized because there's more bad guys out there looking to unfortunately take advantage of vulnerabilities and cybersecurity to take innocent people's money, to put it bluntly,” Alek Langford, a TRM Labs analyst, told the Chicago Sun-Times earlier this year.