Two men pleaded guilty in federal court in South Florida to extortion-related conspiracy charges stemming from ransomware attacks in 2023, officials announced Monday.
Federal prosecutors say Ryan Goldberg, 40, of Georgia, Kevin Martin, 36, of Texas, and a third co-conspirator used the ALPHV BlackCat ransomware to extort victims across the United States between April and December 2023, officials stated.
Court documents show the men paid ALPHV BlackCat administrators 20% of any ransom in exchange for access to the ransomware and its extortion platform.
All three worked in the cybersecurity industry and had professional experience defending computer systems from the same attacks they carried out, prosecutors said.
After extorting approximately $1.2 million in Bitcoin from one victim, the men split their 80% share evenly and laundered the proceeds through multiple methods, according to court filings.
Prosecutors say ALPHV BlackCat targeted more than 1,000 victims worldwide, operating as a ransomware-as-a-service enterprise. Developers created and maintained the malware and infrastructure, while affiliates identified and attacked high-value targets. Ransom payments were then shared between the groups.
The announcement follows Justice Department actions in December 2023, when the FBI disrupted ALPHV BlackCat by developing a decryption tool that allowed hundreds of victims to recover their systems, preventing an estimated $99 million in ransom payments. Authorities also seized several ALPHV-operated websites.
Goldberg and Martin pleaded guilty to conspiracy to obstruct interstate commerce by extortion.
They are scheduled to be sentenced on March 12, and each faces up to 20 years’ imprisonment.