Two men working in the cybersecurity industry have pleaded guilty in federal court in Florida to carrying out ransomware attacks against multiple U.S. victims using the notorious ALPHV BlackCat malware, federal prosecutors announced Tuesday.
Ryan Goldberg, 40, of Georgia, and Kevin Martin, 36, of Texas, admitted to conspiring to obstruct interstate commerce through extortion in connection with ransomware attacks carried out in 2023. The guilty pleas were accepted by a federal district court in the Southern District of Florida.
According to court documents, Goldberg, Martin and a third co-conspirator deployed ALPHV BlackCat ransomware between April and December 2023, targeting organizations across the United States. The group operated as affiliates of the ALPHV BlackCat ransomware-as-a-service operation, agreeing to pay the malware’s administrators 20% of any ransom payments in exchange for access to the ransomware and its extortion infrastructure.
Prosecutors said all three men were employed in the cybersecurity field, giving them specialized knowledge of how to protect computer systems—skills they instead used to compromise networks and extort victims. In one successful attack, the conspirators extracted approximately $1.2 million in Bitcoin from a victim, later dividing their 80% share of the ransom among themselves and laundering the proceeds through various methods.
“This case underscores that ransomware is not just a foreign threat,” said U.S. Attorney Jason A. Reding Quiñones for the Southern District of Florida, noting that the defendants used “trusted access and technical skill” to carry out the crimes.
The ALPHV BlackCat operation, also known as BlackCat, has been linked to more than 1,000 victims worldwide. It operates under a ransomware-as-a-service model in which developers maintain the malware and online infrastructure while affiliates identify and attack high-value targets. Ransom payments are then shared between the two groups.
Federal officials highlighted that the guilty pleas follow earlier Justice Department action against ALPHV BlackCat. In December 2023, the FBI disrupted the group by seizing several of its websites and releasing a decryption tool that helped hundreds of victims restore their systems, preventing an estimated $99 million in ransom payments.
Goldberg and Martin each pleaded guilty to one count of conspiracy to obstruct, delay or affect commerce by extortion, a charge that carries a maximum sentence of 20 years in prison. They are scheduled to be sentenced on March 12, 2026. A federal judge will determine their sentences after considering federal sentencing guidelines and other statutory factors.
