U.S. federal investigators pursuing the prolific ShinyHunters hacking group—which recently compromised highly sensitive data belonging to the Federal Bureau of Investigation—have identified executives at two separate ransomware negotiation firms who maintained unusually close and illicit relations with the extortion syndicate. According to sources close to the ongoing investigation, one of these executives, based in the United States, even went so far as to help ShinyHunters operate an active online portal designed to pressure victims into submitting to ransom demands.
Hackers aligned with the ShinyHunters banner have claimed credit for dozens of major corporate and institutional data breaches since 2019. During its initial years, the group was primarily operated by cybercriminals residing in France. However, as those foundational members were systematically arrested, detained, or jailed by law enforcement authorities, operational control over the ShinyHunters brand eventually transitioned to an individual known online as “Rey.” Last year, investigators identified Rey as a teenage hacker operating out of Amman, Jordan. According to official figures released by the FBI, the ShinyHunters collective has successfully extorted more than $70 million from various victims so far this year alone.
The scope of the group’s operations escalated dramatically in late September, when ShinyHunters successfully breached the FBI recruitment website, fbijobs.gov. In an audacious move, the hackers taunted the federal law enforcement agency by threatening to publish a cache of stolen internal files. Reports indicate that the compromised data included sensitive medical and psychological records, Social Security numbers, home addresses, and detailed professional information regarding the specific units and specializations of various bureau employees.
This high-profile breach of the FBI’s own infrastructure prompted the agency to move with uncommon speed, tracking down, arresting, detaining, and questioning individuals who had maintained any form of communication with Rey or other suspects linked to the ShinyHunters network. On October 3, Reuters reported that Rey had been detained by Jordanian authorities and was actively cooperating with the FBI.
Rey’s ascent to leadership within the hacking group had been facilitated by the sudden removal of one of its alleged senior members. On the evening of September 15, law enforcement authorities in the Netherlands executed a high-stakes arrest, apprehending convicted hacker and prominent ShinyHunters suspect Pepijn van der Stap. Dutch police reportedly deployed flash-bang grenades in a tactical effort to stun and secure Van der Stap precisely while he was actively logged into various online accounts.
According to sources close to the investigation, authorities managed to capture Van der Stap while he was actively using his Signal instant messaging application. This tactical advantage allowed investigators to instantly access and review recent communications with his most frequent contacts, a digital trail that led directly to ransomware negotiators based in both Canada and the United States.
Multiple knowledgeable sources confirmed to KrebsOnSecurity that Van der Stap’s decrypted Signal messages served as the pivotal clue required to unravel a disturbing murder-for-hire plot that surfaced immediately following his arrest. The Dutch news outlet RTL reported last month that two murders were allegedly planned to be carried out abroad, with strong indications suggesting that Van der Stap had issued the orders for the attacks, though officials noted there is no evidence indicating those violent directives were ever actually executed.
The digital evidence continued to yield major enforcement actions. On October 9, KrebsOnSecurity broke the news that the FBI had arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the broadening ShinyHunters investigation. Dubrovsky, who recently published a book on handling cyber extortion that explicitly recommended always engaging with hackers, was formally charged with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion, according to federal court records. Politico reported that federal prosecutors requested Dubrovsky remain in custody pending trial, and that all records associated with his criminal case remain placed under judicial seal.
A source close to the investigation revealed that Van der Stap’s Signal message history demonstrated frequent, direct conversations between the Dutch hacker, Dubrovsky, and at least one executive at a prominent U.S.-based consulting firm. Remarkably, these communications showed that the executives frequently possessed detailed knowledge regarding newly breached ShinyHunters victims well before the victim organizations themselves had even discovered the security intrusions.
Furthermore, investigators uncovered what they described as a potentially explosive finding within the Dutch hacker’s chat logs: Edward Dubrovsky was fully aware that ShinyHunters had exfiltrated highly sensitive data from official FBI servers. Despite this knowledge, Dubrovsky never informed the bureau of the catastrophic data breach prior to the criminal group publicly threatening on social media platform X to release the agency’s deeply personal personnel files.
SHINYWIRE
As the investigation deepened, KrebsOnSecurity learned from two separate sources close to the probe that federal investigators believe at least one executive at a U.S.-based consulting firm played an active, operational role in maintaining the now-defunct ShinyHunters victim extortion website known as shinywire[.]com. While investigators have identified the firm—a prestigious organization boasting more than 1,000 associates—news outlets are withholding the names of the company and the specific executive pending formal criminal charges.
The Shinywire portal remained active from approximately May 3 until October 16, hosting profiles for nearly 100 distinct organizations that had been compromised by ShinyHunters. Each entry on the site pressured victim entities to initiate contact with the cybercrime syndicate to negotiate payment terms. To substantiate their threats, the web pages featured samples of stolen proprietary files and warned that the entirety of the pilfered data would be published publicly online if the targeted organizations ignored the extortion demands.
Cached data archived by scanning services such as urlscan.io illustrated the mechanics of the site, including an extortion demand targeting Intuitive Surgical, an American medical technology company that suffered a breach in March after an employee fell victim to a targeted phishing campaign. Under the operating model of the site, victim organizations that refused to engage in communications or negotiate within a strict seven-day window found their stolen corporate data published on the primary ShinyHunters shaming blog, which was hosted exclusively on the Tor anonymity network.
The fallout from these investigations has also illuminated bitter infighting within the cybersecurity industry. In mid-October, The Globe and Mail reported that months prior to his arrest by the FBI, Edward Dubrovsky had filed a civil lawsuit in Ontario alleging he had become collateral damage in a malicious campaign orchestrated by a former business partner seeking to destroy another industry executive.
Court filings indicated that Dubrovsky sued Daniel Tobok, the former chief executive of Cypfer, a prominent cybersecurity firm founded in Toronto with international offices spanning the United States, Britain, the Netherlands, the United Arab Emirates, and Mexico. Having originally partnered in 2017 to build Cypfer—where Dubrovsky served as managing partner and chief operating officer—the two executives experienced a severe falling out by 2024. Dubrovsky accused Tobok of systematically sidelining him from core business decisions and exhibiting increasingly erratic behavior. Tobok denied the allegations, filing a counterclaim accusing Dubrovsky of misappropriating confidential information and competing unfairly through a separate entity known as CyberSteward Inc., while asserting that Dubrovsky was merely an employee rather than a founding shareholder.
GHOSTBYTE
Interviews with former colleagues of Daniel Tobok revealed that as far back as eight years ago, the executive was known within certain ransomware circles by a specific online pseudonym: Ghostbyte. In 2018, a Canadian corporation suffered a crippling ransomware attack orchestrated by Dharma, a prolific Russian-language affiliate program that first emerged in 2016. When the victim company informed the Dharma representative that they were leaning toward paying the ransom because critical encrypted files could not be otherwise recovered, they requested firmer guarantees that the hackers would honor their word upon payment.
In an email reply, a copy of which was reviewed by investigators, the Dharma representative instructed the victim to contact an IT professional in Canada who specialized in resolving such incidents, specifically directing them to reach out to the email address [email protected]. The hacker representative advised the company to establish a formal service contract with the individual, noting that the arrangement was a reliable way to navigate the extortion process.
While public records do not definitively confirm whether Tobok personally utilized the Ghostbyte email address provided by the Dharma affiliate, a search conducted by breach tracking service Constella Intelligence revealed that an email address frequently used by Tobok—[email protected]—was directly linked to multiple online accounts utilizing the username "ghostbyte," including a Snapchat profile. Furthermore, Constella’s intelligence tracking connected the Dharma representative’s email address to a specific cryptocurrency wallet that had processed dozens of transactions totaling substantial bitcoin holdings.
In an official statement released in mid-October, Cypfer maintained that its corporate operations do not involve making or facilitating ransomware payments, and asserted that company leadership learned of Dubrovsky’s arrest exclusively through media reports. Representatives emphasized that Cypfer had received no outreach from law enforcement and was not the target of any ongoing investigation. The statement further clarified that CyberSteward and Cypfer operate as entirely separate entities with no shared officers, directors, or employees, noting that Cypfer was recently acquired by the Apros Group, a holding company led by former FBI special agent and former Aon Cyber Solutions CEO Jason Hogg.
CONFLICTING INTERESTS
The legal and ethical landscape surrounding ransomware negotiations remains complex. Under United States law, it is not inherently illegal to pay a cybercriminal group to obtain an encryption key or secure a promise to delete stolen data, provided the recipient entity is not officially sanctioned by the U.S. Treasury Department’s Office of Foreign Assets Control. Because ShinyHunters has not been placed on formal government sanction lists, many victimized companies routinely engage third-party intermediaries to manage negotiations.
However, industry dynamics often create deep conflicts of interest. Insurance providers frequently direct breached organizations to specific incident response firms. While some forensic companies charge flat retainer fees, many specialized negotiation firms operate on a commission-based model, collecting a percentage of the total ransom paid out to the threat actors. Security experts argue this financial structure creates a perverse incentive for negotiators to inflate ransom payouts rather than successfully reduce them.
Mark Camillo, chief executive of CyberAcuView—an industry group established by major cyber insurance carriers—pointed out the inherent flaw in commission-based remediation. He noted that allowing a negotiator to profit directly from the ultimate size of a ransomware transaction distorts professional integrity and demands greater transparency across the entire cybersecurity ecosystem.
Federal prosecutors have increasingly targeted abusive practices within the remediation sector. In October, the Department of Justice charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy, alleging he secretly went behind his clients’ backs to pay ransomware groups millions of dollars while inflating invoices billed to the victims. Similarly, in July, a Florida-based ransomware negotiator named Angelo Martino was sentenced to nearly six years in prison for conspiring with the Blackcat/ALPHV ransomware syndicate to provide confidential victim negotiation strategies that allowed the cybercriminals to maximize their extortion profits.
As law enforcement agencies continue to dismantle the infrastructure supporting groups like ShinyHunters and scrutinize the actions of those who bridge the gap between corporations and cybercriminals, the investigation underscores the growing regulatory pressure facing the multi-million-dollar cyber extortion remediation industry.
Leave a Reply