Ransomware Negotiator Sentenced to 70 Months for BlackCat Aiding

A 41-year-old former ransomware negotiator was sentenced to 70 months in prison on March 12, 2024, for their involvement in a conspiracy with the BlackCat ransomware group. Federal prosecutors stated that the negotiator, identified as Elias Thorne, aided BlackCat operators in extorting multiple victims. Thorne also collaborated with two other cybersecurity professionals in 2023 to target additional victims, according to a sentencing memorandum filed by federal prosecutors.

The U.S. Department of Justice (DOJ) announced the sentencing, highlighting Thorne's role in facilitating ransomware attacks. The BlackCat ransomware-as-a-service operation was known for its sophisticated attacks and its operators' ability to evade law enforcement. Thorne's actions provided a critical service to these cybercriminals by negotiating payments and potentially advising on victim selection and negotiation strategies.

This case underscores the increasing efforts by law enforcement to prosecute individuals who facilitate ransomware attacks, even if they are not the direct perpetrators of the initial intrusion. The DOJ emphasized that individuals who profit from or enable cybercriminal enterprises face significant legal consequences. The BlackCat group, also known as ALPHV or Noberus, has been linked to numerous high-profile attacks globally before its reported shutdown in late 2023, though its affiliates may continue to operate independently.

Thorne's sentence reflects the severity of his actions, which contributed to financial losses and operational disruptions for victim organizations. The prosecution argued that his expertise in negotiation was instrumental in the success of the ransomware operations he supported. The 70-month sentence is a substantial period, intended to serve as a deterrent to others considering similar roles in cybercrime.