The U.S. Department of Justice said a federal court in the Southern District of Florida has accepted plea agreements from two American men who admitted taking part in ransomware attacks using ALPHV, also known as BlackCat. Prosecutors said the pair conspired in 2023 to target multiple victims in the United States and use digital extortion to obtain illicit proceeds.
Defendants had experience in the cybersecurity industry
Court documents identified the defendants as Ryan Goldberg, 40, of Georgia, and Kevin Martin, 36, of Texas. Along with another co-conspirator, they deployed BlackCat ransomware against several U.S. targets between April and December 2023. The case drew added attention because all three had previously worked in cybersecurity and had experience with network defense and system protection.
That detail sits at the center of the DOJ’s message. The department said ransomware threats do not come only from foreign actors; domestic offenders with insider-level technical knowledge can also pose serious risks.
BlackCat used a ransomware-as-a-service revenue split
According to the DOJ, ALPHV BlackCat operated as a ransomware-as-a-service (RaaS) platform. Developers supplied the malware and supporting infrastructure, while affiliates carried out the actual intrusions. To gain access to the service, Goldberg and his associates agreed to hand over 20% of each successful ransom payment to BlackCat’s administrators.
In one attack, the group extorted roughly $1.2 million worth of bitcoin from a single victim. After the proceeds were divided, they used multiple methods to launder the funds and conceal the origin of the money.
More than 1,000 victims were linked to the group
The Justice Department said ALPHV BlackCat attacked more than 1,000 victims worldwide, making it one of the most destructive ransomware operations in recent years. In December 2023, the FBI carried out a major enforcement action against the group, developed a decryption tool, and helped hundreds of victims recover their systems.
U.S. authorities estimated that operation prevented about $99 million in ransom losses. Investigators also seized several websites operated by BlackCat. The DOJ said enforcement efforts will continue across the ransomware chain, including people and entities that knowingly assist or profit from the activity.
Sentencing is scheduled for March 2026
Goldberg and Martin each pleaded guilty to one count of conspiracy to commit an offense involving extortionate interference with commerce. They are scheduled to be sentenced on March 12, 2026. The charge carries a maximum penalty of 20 years in prison, though the final sentence will be decided by the judge under federal sentencing guidelines and the facts of the case.
The DOJ also urged companies and institutions to contact law enforcement quickly after a ransomware incident to limit losses and reduce the number of future victims.