A security researcher who publicly advised companies on ransomware negotiations has been sentenced to four years in prison for secretly conspiring with the BlackCat ransomware group (also known as ALPHV). While hired to help victims during attacks, he was simultaneously operating as an affiliate, receiving 80% of ransom payments and splitting proceeds with two other collaborators.
His victims included at least five organizations that collectively paid over $50 million in ransoms. The dual role allowed him to exploit his trusted position—companies hired him believing he was protecting their interests, when he was actually facilitating the very attacks he claimed to help resolve. This case highlights a critical vulnerability in the ransomware ecosystem: insider threats from security professionals with access to both victim information and criminal networks.
