U.S. prosecutors have charged two rogue employees from the cybersecurity firm DigitalMint, a company that specializes in negotiating ransom payments to hackers for its clients, with carrying out their own ransomware attacks. Last month, the Department of Justice indicted Kevin Tyler Martin and another unnamed employee, both of whom worked as ransomware negotiators at DigitalMint. They face three counts of computer hacking and extortion related to a series of attempted ransomware attacks against at least five companies based in the United States.
Prosecutors also charged a third individual, Ryan Clifford Goldberg, a former incident response manager at the cybersecurity giant Sygnia, as part of the same scheme. The three are accused of hacking into companies, stealing sensitive data, and deploying ransomware that was developed by the ALPHV/BlackCat group.
The ALPHV/BlackCat gang uses a ransomware-as-a-service model. In this model, the gang develops the file-encrypting malware used to steal and scramble victim data, while its affiliates, such as the three indicted individuals, carry out the hacks and deploy the ransomware. The gang then takes a portion of the profits from any ransom payments.
According to an FBI affidavit filed in September, the rogue employees received more than one point two million dollars in ransom payments from one victim, a medical device maker located in Florida. They also targeted several other companies, including a drone maker based in Virginia and a pharmaceutical company headquartered in Maryland. The indictment was first reported on Sunday.
Sygnia chief executive Guy Segal confirmed that Goldberg was a Sygnia employee and was terminated after the company learned of his alleged involvement in the ransomware attacks. Sygnia declined to comment further, citing the FBI’s ongoing investigation.
DigitalMint president Marc Grens stated that Martin was an employee at the time of the alleged hacks but was acting completely outside the scope of his employment. Grens also confirmed that the unnamed individual charged may be a former employee. DigitalMint is cooperating with the government’s investigation.