{"id":79776,"date":"2025-11-05T01:14:38","date_gmt":"2025-11-04T23:14:38","guid":{"rendered":"https:\/\/digitrendz.blog\/?p=79776"},"modified":"2025-11-05T01:14:58","modified_gmt":"2025-11-04T23:14:58","slug":"us-cybersecurity-experts-charged-in-blackcat-ransomware-case","status":"publish","type":"post","link":"https:\/\/digitrendz.blog\/z\/newswire\/business\/79776\/us-cybersecurity-experts-charged-in-blackcat-ransomware-case\/","title":{"rendered":"US Cybersecurity Experts Charged in BlackCat Ransomware Case"},"content":{"rendered":"<details class=\"wp-block-details ticss-586932b6 is-layout-flow wp-block-details-is-layout-flow\"><summary>\u25bc Summary<\/summary>\n<p class=\"ticss-0c48f427 has-small-font-size wp-block-paragraph\">&#8211; Three former cybersecurity employees from DigitalMint and Sygnia have been indicted for allegedly hacking five U.S. companies in BlackCat ransomware attacks between May and November 2023.<br>&#8211; The defendants face charges including conspiracy to commit extortion and intentional damage to computers, with potential prison sentences of up to 50 years if convicted.<br>&#8211; They are accused of operating as ALPHV BlackCat affiliates, gaining unauthorized network access, stealing data, deploying encryption malware, and demanding cryptocurrency ransoms.<br>&#8211; Ransom demands ranged from $300,000 to $10 million, with only one confirmed payment of $1.27 million made by a Tampa medical device manufacturer.<br>&#8211; The FBI has linked BlackCat to over 60 breaches and at least $300 million in ransom payments from more than 1,000 victims by September 2023.<br><\/p>\n<\/details>\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n<p class=\"has-drop-cap wp-block-paragraph\"><mark style=\"background-color:rgba(0, 0, 0, 0);color:#f34c3e\" class=\"has-inline-color\">A<\/mark> federal indictment has charged three <a href=\"https:\/\/digitrendz.blog\/z\/tech-news\/203632\/us-cyber-experts-urge-lifting-of-ban-on-anthropics-ai-models\/\" class=\"acp-article-link\" data-article-id=\"203632\" title=\"US Cyber Experts Urge Lifting of Ban on Anthropic&#039;s AI Models\" target=\"_blank\" rel=\"noopener noreferrer\">cybersecurity professionals<\/a> with orchestrating a series of <a href=\"https:\/\/digitrendz.blog\/z\/entity\/blackcat\/\" class=\"acp-entity-link\" data-entity-id=\"21375\" data-entity-category=\"Organization\" title=\"Learn more about BlackCat\" target=\"_blank\" rel=\"noopener noreferrer\">BlackCat<\/a> <a href=\"https:\/\/digitrendz.blog\/z\/newswire\/business\/177753\/two-cybersecurity-workers-jailed-for-blackcat-ransomware-attacks\/\" class=\"acp-article-link\" data-article-id=\"177753\" title=\"Two Cybersecurity Workers Jailed for BlackCat Ransomware Attacks\" target=\"_blank\" rel=\"noopener noreferrer\">ransomware attacks<\/a> against American companies. The accused, who previously held trusted roles at prominent incident response firms, allegedly leveraged their industry knowledge to breach networks, steal sensitive data, and extort substantial <a href=\"https:\/\/digitrendz.blog\/z\/topic\/cryptocurrency-payments\/\" class=\"acp-topic-link\" data-topic-id=\"91563\" title=\"Explore: cryptocurrency payments\" target=\"_blank\" rel=\"noopener noreferrer\">cryptocurrency payments<\/a> from their victims.<\/p>\n\n<p class=\"wp-block-paragraph\">Facing serious charges are <strong><a href=\"https:\/\/digitrendz.blog\/z\/entity\/kevin-tyler-martin\/\" class=\"acp-entity-link\" data-entity-id=\"150591\" data-entity-category=\"Person\" title=\"Learn more about Kevin Tyler Martin\" target=\"_blank\" rel=\"noopener noreferrer\">Kevin Tyler Martin<\/a><\/strong>, a 28-year-old from <a href=\"https:\/\/digitrendz.blog\/z\/entity\/roanoke\/\" class=\"acp-entity-link\" data-entity-id=\"150594\" data-entity-category=\"Location\" title=\"Learn more about Roanoke\" target=\"_blank\" rel=\"noopener noreferrer\">Roanoke<\/a>, Texas, and <strong><a href=\"https:\/\/digitrendz.blog\/z\/entity\/ryan-clifford-goldberg\/\" class=\"acp-entity-link\" data-entity-id=\"150592\" data-entity-category=\"Person\" title=\"Learn more about Ryan Clifford Goldberg\" target=\"_blank\" rel=\"noopener noreferrer\">Ryan Clifford Goldberg<\/a><\/strong>, a 33-year-old from <a href=\"https:\/\/digitrendz.blog\/z\/entity\/watkinsville\/\" class=\"acp-entity-link\" data-entity-id=\"150595\" data-entity-category=\"Location\" title=\"Learn more about Watkinsville\" target=\"_blank\" rel=\"noopener noreferrer\">Watkinsville<\/a>, <a href=\"https:\/\/digitrendz.blog\/z\/entity\/georgia\/\" class=\"acp-entity-link\" data-entity-id=\"12924\" data-entity-category=\"Location\" title=\"Learn more about Georgia\" target=\"_blank\" rel=\"noopener noreferrer\">Georgia<\/a>, alongside an unnamed accomplice. Martin, who has entered a not guilty plea, and Goldberg, who has been in federal custody since last September, are accused of conspiracy to commit extortion, interference with interstate commerce, and intentionally damaging protected computers. A conviction on all counts carries a potential prison sentence of up to 50 years.<\/p>\n\n<p class=\"wp-block-paragraph\">Court documents reveal that Martin and the unnamed individual worked as ransomware threat negotiators for <a href=\"https:\/\/digitrendz.blog\/z\/entity\/digitalmint\/\" class=\"acp-entity-link\" data-entity-id=\"150593\" data-entity-category=\"Organization\" title=\"Learn more about DigitalMint\" target=\"_blank\" rel=\"noopener noreferrer\">DigitalMint<\/a>, while <a href=\"https:\/\/digitrendz.blog\/z\/newswire\/business\/146889\/us-charges-blackcat-ransomware-negotiator-in-major-crackdown\/\" class=\"acp-article-link\" data-article-id=\"146889\" title=\"US Charges BlackCat Ransomware Negotiator in Major Crackdown\" target=\"_blank\" rel=\"noopener noreferrer\">Goldberg<\/a> was formerly an incident response manager at <a href=\"https:\/\/digitrendz.blog\/z\/entity\/sygnia\/\" class=\"acp-entity-link\" data-entity-id=\"36562\" data-entity-category=\"Organization\" title=\"Learn more about Sygnia\" target=\"_blank\" rel=\"noopener noreferrer\">Sygnia<\/a>. The Department of Justice alleges the trio operated as affiliates for the <a href=\"https:\/\/digitrendz.blog\/z\/entity\/alphv\/\" class=\"acp-entity-link\" data-entity-id=\"21376\" data-entity-category=\"Organization\" title=\"Learn more about ALPHV\" target=\"_blank\" rel=\"noopener noreferrer\">ALPHV<\/a> ransomware gang, also known as BlackCat. Their purported scheme involved gaining unauthorized access to corporate networks, exfiltrating data, and deploying file-encrypting malware. They would then demand cryptocurrency ransoms in exchange for decryption keys and promises not to publish the stolen information.<\/p>\n\n<p class=\"wp-block-paragraph\">The indictment identifies five companies across the United States as victims. The list includes a medical device manufacturer based in Tampa, a pharmaceutical company in <a href=\"https:\/\/digitrendz.blog\/z\/entity\/maryland\/\" class=\"acp-entity-link\" data-entity-id=\"19719\" data-entity-category=\"Location\" title=\"Learn more about Maryland\" target=\"_blank\" rel=\"noopener noreferrer\">Maryland<\/a>, a doctor&#8217;s office and an engineering firm, both in <a href=\"https:\/\/digitrendz.blog\/z\/entity\/california\/\" class=\"acp-entity-link\" data-entity-id=\"536\" data-entity-category=\"Place\" title=\"Learn more about California\" target=\"_blank\" rel=\"noopener noreferrer\">California<\/a>, and a drone manufacturer located in Virginia.<\/p>\n\n<p class=\"wp-block-paragraph\">Prosecutors state the ransom demands issued by the group varied dramatically, from $300,000 to a staggering $10 million. <strong>The only confirmed payment came from the Tampa medical device company, which paid $1.27 million after its servers were encrypted and a $10 million demand was made in May 2023.<\/strong> The court filings do not specify if any of the other targeted organizations complied with the extortion demands.<\/p>\n\n<p class=\"wp-block-paragraph\">This case emerges against a backdrop of prior scrutiny. Reports had previously indicated that the Department of Justice was investigating a former DigitalMint negotiator for potentially colluding with ransomware gangs to profit from extortion deals. The relationship between that earlier probe and this new indictment remains unclear. This situation also echoes a 2019 investigative report which found that some data recovery firms secretly paid ransoms to cybercriminals while billing their clients for restoration services, without disclosing the payments.<\/p>\n\n<p class=\"wp-block-paragraph\">The threat posed by the BlackCat ransomware operation has been a significant concern for U.S. authorities. In a joint advisory issued in February 2024, the FBI, CISA, and the Department of Health and Human Services highlighted that BlackCat affiliates were aggressively targeting the American healthcare sector. The FBI has attributed more than 60 data breaches to the group in its first few months of operation and estimates that, by September 2023, the gang had extorted at least $300 million from over 1,000 victims worldwide.<\/p>\n\n<p class=\"wp-block-paragraph\"><em>(Source: <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/us-cybersecurity-experts-indicted-for-blackcat-ransomware-attacks\/\" target=\"_blank\" rel=\"noreferrer noopener\">Bleeping Computer<\/a>)<\/em><\/p>","protected":false},"excerpt":{"rendered":"<p>Three cybersecurity professionals, including Kevin Tyler Martin and Ryan Clifford Goldberg, have been federally indicted for orchestrating BlackCat ransomware attacks, using their industry expertise to breach networks and extort cryptocurrency payments. The accused, who previously worked as ranso&#8230;<\/p>\n","protected":false},"author":1,"featured_media":79775,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_themeisle_gutenberg_block_has_review":false,"cybocfi_hide_featured_image":"","footnotes":""},"categories":[3253,3297,3327,3254],"tags":[114212,114214,114215,74807,114213],"entities":[114221,114222,14636,815,10366,4822,114218,7578,114216,13197,114219,114217,26199,24796,2818,114220],"class_list":["post-79776","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-business","category-cybersecurity","category-newswire","category-technology","tag-blackcat-ransomware","tag-cryptocurrency-ransom","tag-cybersecurity-professionals","tag-data-extortion","tag-ransomware-indictment","entity-alphv-2","entity-alphv-blackcat-2","entity-blackcat","entity-california","entity-chicago-sun-times","entity-department-of-justice","entity-digitalmint","entity-georgia","entity-kevin-tyler-martin","entity-maryland","entity-roanoke","entity-ryan-clifford-goldberg","entity-sygnia","entity-tampa","entity-texas","entity-watkinsville"],"_links":{"self":[{"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/posts\/79776","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/comments?post=79776"}],"version-history":[{"count":0,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/posts\/79776\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/media\/79775"}],"wp:attachment":[{"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/media?parent=79776"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/categories?post=79776"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/tags?post=79776"},{"taxonomy":"entity","embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/entities?post=79776"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}