When cyber professionals go rogue: A former ‘ransomware negotiator’ has been charged amid claims they attacked and extorted businesses
The attackers are alleged to have demanded ransoms of up to $10 million
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
You are now subscribed
Your newsletter sign-up was successful
Two former workers at cybersecurity firms have been indicted for hacking offences in the United States.
Kevin Tyler Martin, Ryan Clifford Goldberg, and another unnamed co-conspirator are accused of hacking the networks of a medical device company, a pharmaceutical company, a doctor's office, an engineering company, and a drone manufacturer.
The campaign of attacks was carried out between May and November 2023, with the trio alleged to have used ALPHV, also known as BlackCat, ransomware.
They demanded a $10 million ransom from the medical device maker, ultimately receiving around $1.27 million - their only successful attack. Other ransom demands ranged from $300,000 to $5 million.
According to the Chicago Sun-Times, Martin was a ransomware threat negotiator for incident response firm DigitalMint, along with a suspected accomplice who wasn’t indicted. Goldberg, meanwhile, was an incident response manager for Sygnia Cybersecurity Services.
An FBI affidavit shows Goldberg told agents he took part in the scheme to try and get out of debt. If convicted, he and Martin each face up to 50 years in federal prison. There's no suggestion that either DigitalMint or Sygnia was involved.
Cyber pros turning rogue is a real threat
Jamie Akhtar, CEO and co-founder of CyberSmart, said that while insider threats are a well known risk across all sectors, this case highlights a risk – albeit rate – that’s difficult to guard against.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
Employees in tech and security roles are often highly skilled and trusted with privileged access – a dangerous combination if oversight and support are lacking.
"This incident is one of the most unusual we’ve seen, not least because the accused allegedly directed their actions outward, rather than at their own employer," Akhtar said.
"Even within cybersecurity vendors, not everyone has pure intentions. Just because an organization specializes in defence doesn’t mean it’s immune from becoming a source of risk," he added.
"Financial pressure, stress or personal grievances can all push individuals toward actions they might never have considered before. Prevention means not just monitoring systems, but also understanding and supporting the people who use them. Trust is essential, but it must always be verified."
New research this week from Cybersecurity Insiders and Cogility found that 93% of security leaders saw insider threats as harder to detect than external cyberattacks.
Only 23% expressed strong confidence in stopping them before serious damage occurs. Only 12% said they had mature predictive risk models.
“Without context like financial stress or behavioral shifts, security teams are watching shadows on the wall while the real danger moves unchecked," warned Holger Schulze, founder of Cybersecurity Insiders.
"If organizations fail to evolve, they’ll be reading about their data on the dark web before they ever see it in their logs.”
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.
-
Anthropic researchers warn AI could 'inhibit skills formation' for developersNews A research paper from Anthropic suggests we need to be careful deploying AI to avoid losing critical skills
-
CultureAI’s new partner program targets AI governance gains for resellersNews The new partner framework aims to help resellers turn AI governance gaps into scalable services revenue
-
Notepad++ hackers remained undetected and pushed malicious updates for six months – here’s who’s responsible, how they did it, and how to check if you’ve been affectedNews Hackers remained undetected for months and distributed malicious updates to Notepad++ users after breaching the text editor software – here's how to check if you've been affected.
-
CISA’s interim chief uploaded sensitive documents to a public version of ChatGPT – security experts explain why you should never do thatNews The incident at CISA raises yet more concerns about the rise of ‘shadow AI’ and data protection risks
-
Former Google engineer convicted of economic espionage after stealing thousands of secret AI, supercomputing documentsNews Linwei Ding told Chinese investors he could build a world-class supercomputer
-
90% of companies are woefully unprepared for quantum security threats – analysts say they need to get a move onNews Quantum security threats are coming, but a Bain & Company survey shows systems aren't yet in place to prevent widespread chaos
-
LastPass issues alert as customers targeted in new phishing campaignNews LastPass has urged customers to be on the alert for phishing emails amidst an ongoing scam campaign that encourages users to backup vaults.
-
NCSC names and shames pro-Russia hacktivist group amid escalating DDoS attacks on UK public servicesNews Russia-linked hacktivists are increasingly trying to cause chaos for UK organizations
-
An AWS CodeBuild vulnerability could’ve caused supply chain chaos – luckily a fix was applied before disaster struckNews A single misconfiguration could have allowed attackers to inject malicious code to launch a platform-wide compromise
-
There’s a dangerous new ransomware variant on the block – and cyber experts warn it’s flying under the radarNews The new DeadLock ransomware family is taking off in the wild, researchers warn
