FORMER RANSOMWARE NEGOTIATOR PLEADS GUILTY TO EXTORTION
AI DESK■ 1 MIN READ
WED, APR 22, 2026■ AI-SUMMARIZED FROM 2 SOURCES ▸ TIMELINE
Angelo Martino, a former ransomware negotiator, has pleaded guilty to assisting cybercriminals in extorting companies across five separate cyberattacks, according to the US Department of Justice.
Martino's guilty plea represents a significant case of insider collaboration in ransomware operations. His role as a negotiator—typically hired by companies to communicate with hackers—positioned him with critical knowledge of victim vulnerabilities and negotiation tactics.
The charges span five distinct incidents where Martino allegedly provided assistance to cybercriminals conducting extortion schemes. By leveraging his expertise in ransom negotiations and understanding of how companies respond to attacks, Martino reportedly facilitated more effective extortion campaigns.
The case underscores growing concerns about insider threats in cybersecurity. Professionals with access to sensitive negotiation details and victim information represent a high-risk vulnerability that organizations must address through vetting and monitoring.
Martino's prosecution follows increased DOJ focus on ransomware operations and the networks supporting them. Federal authorities have intensified efforts to prosecute not only the hackers executing attacks but also facilitators and intermediaries enabling criminal enterprises.
■ MORE FROM THE SECURITY DESK
Cybercriminals have transformed DDoS attacks into a polished, commercialized service complete with pricing tiers, customer support, and reseller programs. The DDoS-as-a-Service market has evolved from basic tools into sophisticated attack platforms.
YESTERDAY— Industry Desk
Microsoft faced backlash after threatening a security researcher with criminal investigation, reigniting debate over software vulnerability disclosure practices and corporate responsibility.
YESTERDAY— Security Desk
Google is deploying Device Bound Session Credentials (DBSC) to all Chrome users, a security feature designed to prevent account takeovers by protecting session cookies from theft.
YESTERDAY— Industry Desk
Dutch authorities have dismantled a major botnet comprising 17 million infected devices and seized over 200 servers hosting the operation at a local provider.
YESTERDAY— Security Desk