When cyber professionals go rogue: A former ‘ransomware negotiator’ has been charged amid claims they attacked and extorted businesses
The attackers are alleged to have demanded ransoms of up to $10 million
Two former workers at cybersecurity firms have been indicted for hacking offences in the United States.
Kevin Tyler Martin, Ryan Clifford Goldberg, and another unnamed co-conspirator are accused of hacking the networks of a medical device company, a pharmaceutical company, a doctor's office, an engineering company, and a drone manufacturer.
The campaign of attacks was carried out between May and November 2023, with the trio alleged to have used ALPHV, also known as BlackCat, ransomware.
They demanded a $10 million ransom from the medical device maker, ultimately receiving around $1.27 million - their only successful attack. Other ransom demands ranged from $300,000 to $5 million.
According to the Chicago Sun-Times, Martin was a ransomware threat negotiator for incident response firm DigitalMint, along with a suspected accomplice who wasn’t indicted. Goldberg, meanwhile, was an incident response manager for Sygnia Cybersecurity Services.
An FBI affidavit shows Goldberg told agents he took part in the scheme to try and get out of debt. If convicted, he and Martin each face up to 50 years in federal prison. There's no suggestion that either DigitalMint or Sygnia was involved.
Cyber pros turning rogue is a real threat
Jamie Akhtar, CEO and co-founder of CyberSmart, said that while insider threats are a well known risk across all sectors, this case highlights a risk – albeit rate – that’s difficult to guard against.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
Employees in tech and security roles are often highly skilled and trusted with privileged access – a dangerous combination if oversight and support are lacking.
"This incident is one of the most unusual we’ve seen, not least because the accused allegedly directed their actions outward, rather than at their own employer," Akhtar said.
"Even within cybersecurity vendors, not everyone has pure intentions. Just because an organization specializes in defence doesn’t mean it’s immune from becoming a source of risk," he added.
"Financial pressure, stress or personal grievances can all push individuals toward actions they might never have considered before. Prevention means not just monitoring systems, but also understanding and supporting the people who use them. Trust is essential, but it must always be verified."
New research this week from Cybersecurity Insiders and Cogility found that 93% of security leaders saw insider threats as harder to detect than external cyberattacks.
Only 23% expressed strong confidence in stopping them before serious damage occurs. Only 12% said they had mature predictive risk models.
“Without context like financial stress or behavioral shifts, security teams are watching shadows on the wall while the real danger moves unchecked," warned Holger Schulze, founder of Cybersecurity Insiders.
"If organizations fail to evolve, they’ll be reading about their data on the dark web before they ever see it in their logs.”
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.
-
NHS supplier DXS International confirms cyber attack – here’s what we know so farNews The NHS supplier says front-line clinical services are unaffected
-
LastPass hit with ICO fine after 2022 data breach exposed 1.6 million users – here’s how the incident unfoldedNews The impact of the LastPass breach was felt by customers as late as December 2024
-
Researchers claim Salt Typhoon masterminds learned their trade at Cisco Network AcademyNews The Salt Typhoon hacker group has targeted telecoms operators and US National Guard networks in recent years
-
Trend Micro issues warning over rise of 'vibe crime' as cyber criminals turn to agentic AI to automate attacksNews Trend Micro is warning of a boom in 'vibe crime' - the use of agentic AI to support fully-automated cyber criminal operations and accelerate attacks.
-
Cyber budget cuts are slowing down, but that doesn't mean there's light on the horizon for security teamsNews A new ISC2 survey indicates that both layoffs and budget cuts are on the decline
-
NCSC issues urgent warning over growing AI prompt injection risks – here’s what you need to knowNews Many organizations see prompt injection as just another version of SQL injection - but this is a mistake
-
Chinese hackers are using ‘stealthy and resilient’ Brickstorm malware to target VMware servers and hide in networks for months at a timeNews Organizations, particularly in the critical infrastructure, government services, and facilities and IT sectors, need to be wary of Brickstorm
-
AWS CISO Amy Herzog thinks AI agents will be a ‘boon’ for cyber professionals — and teams at Amazon are already seeing huge gainsNews AWS CISO Amy Herzog thinks AI agents will be a ‘boon’ for cyber professionals, and the company has already unlocked significant benefits from the technology internally.


