Threats · 133 days ago
The risk is not just ransomware access. It is trusted defenders turning their incident-response skills into affiliate work for an extortion crew, which gives attackers better judgment about victims, negotiations, and pressure points than a typical criminal recruit.
Two former employees of Sygnia and DigitalMint were sentenced to four years each after pleading guilty to serving as BlackCat (ALPHV) affiliates from May to November 2023. Prosecutors said they paid for access to BlackCat's ransomware and extortion platform, hit multiple U.S. victims, and targeted sectors including healthcare, manufacturing, engineering, drone manufacturing, and a doctor's office.
The pattern matters because it shows ransomware groups can recruit people who already know how defenders think and how victims respond. That makes insider expertise part of the threat landscape, not just insider access.
8 sources covering this story
Two cybersecurity pros get prison time for helping ransomware gang - Help Net Security
cybersecurity experts sentenced to 4 years for ALPHV/BlackCat ransomware attacks, extorting victims and laundering millions.
Two Cybersecurity Professionals Get 4-Year Sentences in BlackCat Ransomware Attacks
Two cybersecurity experts got 4-year sentences after enabling 2023 BlackCat attacks, exposing insider abuse and $1.2M ransom impact.
The Record from Recorded Future
Cyber incident responders who carried out ransomware attacks given 4-year sentences
Two cybersecurity incident responders who abused their positions to carry out covert ransomware attacks were sentenced to four years in prison.
Two US Security Experts Sentenced to Prison for Helping Ransomware Gang
Ryan Goldberg of Georgia and Kevin Martin of Texas were each sentenced to four years in prison.
Two Cybersecurity Workers Jailed for BlackCat Ransomware Attacks
The cybersecurity workers used their knowledge and skills to conduct ransomware attacks for notorious gang, rather than protect victims against them
A Ransomware Negotiator Was Working for a Ransomware Gang - Schneier on Security
Someone pleaded guilty to secretly working for a ransomware gang as he negotiated ransomware payments for clients.
US ransomware negotiators get 4 years in prison over BlackCat attacks
companies in BlackCat (ALPHV) ransomware attacks.
Former incident responders sentenced to 4 years in prison for committing ransomware attacks
Ryan Goldberg and Kevin Martin attacked five companies in 2023 and extorted nearly $1.3 million from one of their victims.
Part of the PlainSec briefing for 2026-05-01