Security experts themselves carried out ransomware attacks

"Two American cybersecurity employees have pleaded guilty to attacks using the BlackCat/ALPHV ransomware. Ryan Goldberg and Kevin Martin earned millions by extorting organizations, including a medical company that paid $1.2 million in ransom. They each face up to 20 years in prison. The men worked as incident response managers and ransomware negotiators at cybersecurity companies. Goldberg worked as an incident response supervisor at Sygnia Consulting, while Martin was a ransomware negotiator for DigitalMint."

"Goldberg and Martin made a deal with the administrators of the BlackCat/ALPHV ransomware. They paid 20 percent of each ransom amount to the ransomware group. In exchange, they gained access to the criminal organization's malware and extortion platform. They shared their 80 percent share with a third suspect, who has not been named. One victim, a medical company, paid approximately $1.2 million in Bitcoin. The three suspects divided their share of $960,000 among themselves and laundered the money using various methods. The DoJ points out that the "special skills and experience" of the security employees came in handy in attacking their victims."

Two American cybersecurity employees, Ryan Goldberg and Kevin Martin, pleaded guilty to carrying out BlackCat/ALPHV ransomware attacks and extorting multiple victims between April and December 2023. Both worked in incident response and ransomware negotiation roles at cybersecurity firms and used their expertise to perform attacks rather than prevent them. They struck a deal with BlackCat administrators, paying 20 percent of ransoms for access to malware and an extortion platform while retaining 80 percent and sharing proceeds with an unnamed third suspect. One medical company paid about $1.2 million in Bitcoin, with the trio dividing $960,000 and laundering the funds. The FBI developed a decryption tool in December 2023 that restored hundreds of systems, saved an estimated $99 million in ransom payments, and seized several BlackCat websites.

Read at Techzine Global