A Texas man and a Georgia man pleaded guilty to their roles in a 2023 ransomware scheme that used “BlackCat” technology to extort victims.
Kevin Martin, a 36-year-old from Texas, and Ryan Goldberg, a 40-year-old from Georgia, pleaded guilty to conspiracy to “obstruct, delay or affect commerce” by extortion, according to a release from the Department of Justice. A jury accepted their plea on December 29 in the Southern District of Florida.
“Goldberg and Martin used trusted access and technical skill to extort American victims and profit from digital coercion,” said U.S. Attorney Jason Reding Quiñones in the release. “Their guilty pleas make clear that cybercriminals operating from within the United States will be found, prosecuted, and held to account.”
The suspects allegedly deployed “ALPHV BlackCat” ransomware against multiple victims across America in 2023, extorting one victim for roughly $1.2 million in Bitcoin.
Martin and Goldberg could face up to 20 years in prison. They are set for sentencing on March 12, 2026, and a federal judge will determine the penalty after considering guidelines and other factors.
The Scheme
The suspects and another co-conspirator, who worked in cybersecurity, used the “ALPHV BlackCat” ransomware against multiple victims nationwide from April to December 2023, according to the release. In turn, they agreed to pay the administrators a 20% share of any ransoms in exchange for access to the technology.
The men had “special skills and experience in securing computer systems against harm,” including what they were inflicting. In one case, they extorted a victim for roughly $1.2 million in Bitcoin, then split their 80% share three ways and laundered the money.
Assistant Attorney General Tysen Duva, of the DOJ’s Criminal Division, said in the release that the agency is using “all tools available” to find and arrest ransomware suspects wherever possible.
“These defendants used their sophisticated cybersecurity training and experience to commit ransomware attacks — the very type of crime that they should have been working to stop,” Duva said. “Extortion via the internet victimizes innocent citizens every bit as much as taking money directly out of their pockets.”
FBI-Miami is leading this investigation, with help from the Secret Service. They received help from Assistant U.S. Attorney for the Eastern District of Texas Paul Morris and Assistant U.S. Attorney for the Middle District of Georgia Daniel Peach. The investigative police of the Mexico City International Airport also assisted.
ALPHV BlackCat has targeted computer networks of more than 1,000 victims across the globe, according to the release. The group used a “ransomware-as-a-service” model, with developers responsible for creating, updating, and maintaining the infrastructure, while affiliates carried out the attacks.
“After a victim paid, developers and affiliates shared the ransom,” the release reads.
The DOJ disrupted the ransomware in December 2023, with an FBI decryption tool to help victims restore their systems. This saved them roughly $99 million in ransom payments. Meanwhile, the FBI seized several websites operated by the ransomware group.
“We will continue to leverage our intelligence, law enforcement tools, global presence, and partnerships to counter cybercriminals who seek to harm the American public through these insidious attacks,” said FBI-Miami Special Agent in Charge Brett Skiles in the release.
Groups can report suspicious activity or threats to the FBI’s National Threat Operations Center by calling 1-800-225-5324, visiting the internet tipline, or contacting the local FBI office. Victims should also contact their local FBI office or file a report online.
Anyone with information about ALPHV BlackCat, including affiliates or activities, could be eligible for up to $15 million in rewards through the State Department.
A ransomware group attacked the City of Dallas in 2023, threatening to release information, including contact information, Social Security numbers, and thousands of government documents, as The Dallas Express reported at the time. Officials later admitted the attack reached hundreds more people than they initially announced.
