Federal prosecutors announced that two American cybersecurity professionals admitted to participating in ransomware attacks using the ALPHV/BlackCat platform.
The individuals had previously worked in incident response and ransomware negotiation roles for companies seeking help after cyber incidents. Instead of only assisting victims, they registered as affiliates of the ransomware group and used their expertise to compromise at least five U.S. businesses in 2023.
The defendants used BlackCat ransomware against victim organizations, encrypted systems, and demanded payments in cryptocurrency while agreeing to share a portion of the proceeds with the ransomware operators.
Prosecutors reported that they collectively extorted roughly $1.2 million from a medical device company and other victims.
The defendants pled guilty in federal court to one count of conspiracy to obstruct, delay, or affect commerce by extortion and face up to 20 years in prison at sentencing.
A third U.S. cybersecurity professional who participated in the scheme has also pled guilty and is awaiting sentencing.
Source: https://www.securityweek.com/two-us-cybersecurity-pros-plead-guilty-over-ransomware-attacks/
Commentary
In the above matter, trusted cybersecurity specialists misused their insider knowledge and access to run ransomware attacks against clients.
For employers and IT leaders, the case highlights that the common fear of outsourcing security functions is not imaginary and, as a result, there is outsourcing of accountability.
Vendor betrayal exploits three weaknesses: unchecked trust in experts, inadequate governance, and limited monitoring of high-privilege activity. To counter, management should treat incident responders, managed security providers, and ransomware negotiators as critical-risk roles subject to heightened due diligence, continuous oversight, and explicit contractual constraints on tool use and data management.
To reduce ransomware and insider abuse risk, employers and IT teams should:
- Require enhanced background screening for security-sensitive roles, including vendors with remote or privileged access
- Use least-privilege access and just-in-time elevation for external responders and negotiators, with documented approvals and time limits
- Log and independently review all privileged activity by contractors and security staff, with alerts for anomalous access and encryption tool execution
- Prohibit the unsupervised use of ransomware "test," "simulation," or "negotiation" tooling on production assets, and verify this through technical controls
- Centralize vendor management so security contracts, scopes, and access rights are reviewed by legal, compliance, and information security together
- Require immediate notification to senior management and legal when any responder or vendor proposes direct involvement in ransom payment handling
Boards and executives should also ensure that cyber incident response plans recognize the possibility of a conflicted or rogue responder. That means pre-vetting multiple providers, defining who can authorize responder access, and preserving the ability to quickly revoke credentials, rotate keys, and engage law enforcement if a service partner appears to cross ethical or legal boundaries.
The final takeaway is that ransomware risk management cannot rely solely on trusting experts who "speak the language" of attackers. Security smart employers must pair technical defenses with rigorous vetting, monitoring, and governance of anyone given the keys to their networks and their crises.
Additional Sources: https://www.justice.gov/opa/pr/two-americans-plead-guilty-targeting-multiple-us-victims-using-alphv-blackcat-ransomware https://cyberscoop.com/incident-response-ransomware-professionals-charged-attacks/ https://www.helpnetsecurity.com/2026/05/04/cybersecurity-experts-alphv-blackcat-ransomware-sentenced/ https://www.linkedin.com/posts/cyber-news-live_two-us-cybersecurity-experts-sentenced-in-activity-7456469865940279297-Gcxc
