Two former American cybersecurity professionals have pleaded guilty in federal court for their roles in carrying out ransomware attacks using the notorious ALPHV/BlackCat malware, the very type of threat they were employed to defend against.

According to the U.S. Department of Justice’s Office of Public Affairs, Ryan Clifford Goldberg of Georgia and Kevin Tyler Martin of Texas pleaded guilty in the federal district court in the Southern District of Florida to a single count of conspiracy to obstruct commerce by extortion in relation to multiple ransomware attacks between April and December 2023.

The men, along with an unnamed third co-conspirator, were alleged to have deployed ALPHV/ BlackCat ransomware against several U.S. companies. The deployed malware subsequently encrypted critical systems and ransom payments were demanded in exchange for decryption keys.

There have been many cases of hackers being arrested through 2025, but what makes this case particularly interesting is the background of both defendants, as both held roles in reputable cybersecurity firms. Goldberg is a now former incident response manager at cybersecurity services company Sygnia Ltd. and Martin was a ransomware threat negotiator at cyberthreat intel and incident response firm DigitalMint. Their jobs were to help organizations recover from or defend against ransomware attacks.

Instead of protecting victims, they turned their expertise into a tool for extortion.

Prosecutors alleged that Goldberg, Martin and the third unnamed co-conspirator extorted about $1.2 million in bitcoin from at least one victim, a Tampa-area medical device manufacturer and issued other multimillion-dollar demands to companies in sectors ranging from healthcare to engineering and aerospace. The ransom demands ranged as high as $10 million per attack, although not all resulted in paid ransoms.

“These defendants used their sophisticated cybersecurity training and experience to commit ransomware attacks — the very type of crime that they should have been working to stop,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “Extortion via the internet victimizes innocent citizens every bit as much as taking money directly out of their pockets. The Department of Justice is committed to using all tools available to identify and arrest perpetrators of ransomware attacks wherever we have jurisdiction.”

Goldberg and Martin are scheduled for sentencing on March 12, 2026 and each faces up to 20 years in prison under federal extortion statutes.

Image: SiliconANGLE/Ideogram