[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNlmbUkVNLWCoYvuTlNhgJSv_9bnV0a4giECeN81qlFg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":20,"created_at":21,"published_at":22,"article":23,"tags":27,"podcasts":40,"controls":41},"02e470f6-7b9b-46da-95c5-eb31206bbc26","ransomware-negotiator-turns-insider-threat-for-profit","fb22fd19-3ddf-473d-a41d-43cd3d9c633e","Ransomware Negotiator Turns Insider Threat for Profit","Angelo Martino exploited his privileged position as a ransomware negotiator to secretly collaborate with the BlackCat cybercrime group, sharing confidential victim information to maximize ransom payments in exchange for personal profit. This case demonstrates how trusted third-party service providers can become dangerous insider threats when proper oversight and controls are lacking. The incident highlights the critical need for organizations to thoroughly vet and continuously monitor anyone with access to sensitive incident response activities, as even those hired to help can become complicit with attackers for financial gain.","**Immediate actions:**\n- Conduct thorough background checks and security clearances for all incident response personnel\n- Implement strict access controls limiting negotiator access to only necessary victim information\n- Establish mandatory conflict-of-interest declarations for all third-party security providers\n\n**Long-term improvements:**\n- Deploy continuous monitoring of all communications and activities during incident response engagements\n- Create multi-person approval requirements for sharing sensitive information with external negotiators\n- Develop internal incident response capabilities to reduce reliance on external parties\n\n**Detection measures:**\n- Monitor for unusual financial transactions or lifestyle changes among security personnel\n- Implement audit trails for all access to confidential victim data during incidents\n- Establish whistleblower programs to report suspicious behavior by colleagues or vendors",[12,13,14,15,16,17,18],"CIS Control 5","CIS Control 6","NIST AC-2","NIST AC-6","NIST AT-3","NIST PS-3","NIST IR-2",{},"published","2026-04-22T06:09:34.897381+00:00","2026-04-22T06:09:34.682+00:00",{"id":7,"url":24,"slug":25,"title":26},"https:\u002F\u002Fwww.securityweek.com\u002Fthird-us-security-expert-admits-helping-ransomware-gang\u002F","third-us-security-expert-admits-helping-ransomware-gang-3e851a","Third US Security Expert Admits Helping Ransomware Gang",[28,34],{"id":29,"name":30,"slug":31,"description":32,"color":33},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":35,"name":36,"slug":37,"description":38,"color":39},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[]]