The U.S. Department of Justice has indicted two former employees of DigitalMint, a cybersecurity firm known for negotiating ransom payments on behalf of hacking victims, accusing them of launching ransomware attacks against several U.S. companies while employed as negotiators.
The indictment, filed last month, names Kevin Tyler Martin and another unnamed DigitalMint employee, along with Ryan Clifford Goldberg, a former incident response manager at cybersecurity firm Sygnia. The three face three counts of computer hacking and extortion tied to a series of attempted ransomware operations targeting at least five U.S.-based organizations.
Prosecutors allege the defendants infiltrated corporate networks, stole sensitive data, and deployed ransomware linked to the ALPHV/BlackCat group. The ALPHV/BlackCat operation runs on a ransomware-as-a-service model, in which the developers create the encryption malware while affiliates execute the attacks. In return, the group takes a share of any ransom collected.
According to an FBI affidavit filed in September, the rogue employees received over $1.2 million in ransom payments from one victim, a Florida-based medical device manufacturer. They also allegedly targeted a drone maker in Virginia and a pharmaceutical company in Maryland, among other victims. The Chicago Sun-Times first reported the indictment on Sunday.
Sygnia CEO Guy Segal confirmed to TechCrunch that Goldberg had been employed by the company but was terminated following the discovery of his alleged involvement in the ransomware activity. Segal declined further comment, citing the ongoing FBI investigation.
DigitalMint president Marc Grens told TechCrunch that Martin was indeed employed at the company at the time but said he was “acting completely outside the scope of his employment.” Grens added that the unnamed co-defendant may be a former employee and confirmed that DigitalMint is cooperating with federal investigators.
Featured image credits: Freepik
For more stories like it, click the +Follow button at the top of this page to follow us.