Insider Threat ALPHV / BlackCat Ransomware-as-a-Service
Federal prosecutors have brought an extraordinary case that flips the usual ransomware story on its head: instead of criminal hackers breaking into U.S. businesses, it is trusted cybersecurity professionals who allegedly deployed the ALPHV/BlackCat ransomware and helped extort more than $1.3 million from a Florida medical company.
This case is more than a true-crime headline. It’s a flashing red warning for CISOs and security leaders: people who know your defenses best can also break them most efficiently. Below is an improved, structured analysis of the case, the threat actor (ALPHV), the legal implications, and most importantly, what organizations must do to defend against insider-enabled ransomware.
Deploy the SecureTrust stack, reduce lateral movement, and monitor every endpoint, fully managed for you.
Book a Meeting NowAccording to indictments filed in the U.S. District Court for the Southern District of Florida, three U.S. nationals — all working in or adjacent to professional cybersecurity roles are accused of conspiring to conduct ALPHV/BlackCat ransomware attacks between May 2023 and April 2025.
The group allegedly targeted five U.S. organizations, a Florida medical company, a Maryland pharma firm, a California doctor’s office, a California engineering firm, and a Virginia drone manufacturer. Only the medical organization paid, wiring $1.3 million. Goldberg’s cut was reportedly about $200,000.
ALPHV/BlackCat is one of the most capable ransomware-as-a-service (RaaS) operations to emerge since late 2021. It was among the first major families written in Rust, making it fast, flexible, and portable across Windows and Linux environments.
ALPHV became popular with affiliates because it gave them multiple levers to pressure victims:
This layered threat model is especially powerful against healthcare and manufacturing sectors that cannot afford extended downtime.
By late 2023, the FBI assessed that ALPHV/BlackCat had hit more than 1,000 victims and collected close to $300 million in ransom payments. The group was also linked to the Change Healthcare incident, one of the most disruptive attacks in U.S. health history, costing UnitedHealth an estimated $872 million in direct response and recovery.
Most ransomware cases pit outside attackers against defenders. Here, prosecutors say people with inside-the-SOC knowledge crossed the line.
Goldberg reportedly told the FBI he did it “to get out of debt.” That matters. It tells us that financial stress + privileged access + technical confidence is a real risk combination — even in senior roles.
Both named defendants face serious federal counts:
Each carries hefty maximums — up to 50 years if convicted on all counts.
| Defendant | Role | Status |
|---|---|---|
| R.C. Goldberg | Director of Incident Response | In custody (flight risk) |
| K.T. Martin | Ransomware Negotiator | Released on $400k bond |
| Unnamed Co-conspirator | ALPHV affiliate access | Not fully unsealed |
Sygnia confirmed that Goldberg was employed there and said he was terminated immediately upon learning of the situation. That is a textbook response, but it still raises questions about ongoing high-risk employee monitoring.
DigitalMint confirmed a former employee was indicted and emphasized:
However, the timeline of when the company became aware remains unclear — a reminder that communication transparency is part of incident trust-building.
This case should be immediately folded into enterprise threat modeling. The traditional “external attacker → phishing → lateral movement → ransomware” chain is no longer the only high-probability path.
These align with CISA’s StopRansomware and the FBI’s ransomware guidance:
Ransomware recovery costs averaged $2.7M in 2024 (rebuild, forensics, legal, downtime). Insider participation makes attacks faster and more targeted, raising potential damages.
Law enforcement - through operations like LockBit disruptions and the earlier ALPHV takedown has had success, but RaaS ecosystems rebrand quickly. That means organizations can’t rely on takedowns alone.
Yes. Prosecutors allege people employed in legitimate cybersecurity/crypto roles used that access and knowledge to run ALPHV attacks. That’s what makes it noteworthy.
Because it was prolific, technically mature, and used aggressive triple-extortion. Even after FBI disruptions, affiliates tend to migrate to similar RaaS platforms.
Not to make them punitive, but high-access cyber roles should include deeper background checks, periodic re-screening, and stronger activity monitoring.
Law enforcement and CISA strongly discourage payment because it funds criminal activity and offers no guarantee of data deletion. Resilience (backups, segmentation) is the preferred path.
Disclaimer: This article is an analysis based on publicly available indictments and U.S. law enforcement reporting. All defendants are presumed innocent until proven guilty in a court of law. This content is for informational and security-awareness purposes only and is not legal advice.