An FBI affidavit filed in September offered additional insight into how the group operated. It named only Ryan Goldberg and the other two as co-conspirators 1 and 2. The document described all three accused as negotiators who managed contact with victims through encrypted chat channels on the dark web. They allegedly used aliases, multi-hop cryptocurrency transfers, and privacy coins like Monero to obscure the flow of ransom funds. The FBI called the group’s structure a “professionalized criminal marketplace,” in which developers, brokers, and negotiators each played a distinct role.
The affidavit also detailed how the defendants tracked negotiations using spreadsheets that recorded ransom amounts, payments received, and wallet addresses. “The conspirators maintained meticulous records of their transactions and communications,” the FBI said, noting that such documentation helped agents trace funds and link them to the defendants.
The victims and the demands
The indictment cited at least five victim organizations: a Florida medical-device company, a Maryland pharmaceutical manufacturer, a California doctor’s office, a California engineering firm, and a Virginia-based drone company. On May 13, 2023, the conspirators allegedly attacked the Florida firm, demanding $10 million and receiving roughly $1.27 million in cryptocurrency. Two months later, they hit the California medical practice, seeking $5 million, followed by attacks in October and November 2023 that targeted engineering and drone companies, respectively.
