“As part of their duties, the defendant was provided with details of the attack and the ransom demand, and typically the victim’s applicable insurance coverage and negotiation strategy,” the actual proposal said.
Martino used BlackCat’s live chat system to negotiate the ransom payments. Beginning in April 2023, it began communicating with BlackCat actors on the Tox messaging platform and a separate ‘broker chat’ tab of the BlackCat panel, which was “available only to accountable and BlackCat negotiators and affiliates,” the actual proposal said.
Martino used the intermediary chat tab to provide confidential information about customers.
“The purpose of these mediated conversations was to increase ransom payments made by those victims to BlackCat actors,” the court document states. “This information, which the defendant provided without the victims’ knowledge, included the victims’ insurance policy limits and internal negotiating positions. In exchange for providing confidential information, the defendant received a portion of the ransomware payments in digital currency.”
In May 2023, Martino gained shared access to the BlackCat panel, which he shared with the conspirators. “After the defendant obtained shared access, the defendant, Co-conspirator 1 and Co-Conspirator 2 conspired and used the BlackCat ransomware and platform to attack and extort victims and split the ransom proceeds among themselves and the BlackCat admin,” the actual motion said.
DigitalMint “also an unknown victim”
In a statement to Ars today, DigitalMint said it had no knowledge of criminal activity during Martino’s tenure there. DigitalMint said it fired employees involved in the conspiracy after learning of the allegations from the Justice Department and is “cooperating fully with federal authorities throughout the investigation.”
“The actions of Martino and his co-conspirators were deliberately concealed from DigitalMint and were in clear violation of the company’s values, ethical standards and the law,” DigitalMint said. “The government has now made it clear that DigitalMint was also an unwitting victim of these crimes.”
DigitalMint said Martino had circumvented the company’s internal safeguards to prevent fraud.
“DigitalMint maintained industry-standard controls, including background checks and compliance procedures, but Martino intentionally concealed his conduct from the company, including through separate, unauthorized communication channels described in government filings as accessible only to Martino and BlackCat negotiators and affiliates,” DigitalMint said. “When federal authorities brought the allegations to the company’s attention, DigitalMint took immediate action.”
Sygnia told CNN In November, he and other media outlets terminated Goldberg “immediately after learning of the situation.” Sygnia said the company itself is not a target of the investigation and is cooperating closely with the FBI.
