The widening federal probe follows a brazen cyberattack in late September, when ShinyHunters compromised the FBI recruitment website, fbijobs.gov. The hackers taunted law enforcement by threatening to publish sensitive internal files stolen from the portal, which reportedly included home addresses, Social Security numbers, medical and psychological records, and specific details regarding employee units and specializations.
The compromise of the FBI’s recruitment portal prompted an aggressive response from federal authorities. The investigation gained critical momentum on September 15, 2026, when Dutch police carried out a dramatic arrest in the Netherlands, using flash-bang grenades to apprehend convicted hacker and ShinyHunters suspect Pepijn van der Stap as he remained actively logged into various online accounts. Law enforcement officials seized his Signal instant messaging account during the raid, granting investigators immediate access to recent communications with frequent contacts, including ransomware negotiators based in the United States and Canada.
According to sources familiar with the matter, Van der Stap’s decrypted chat logs served as a breakthrough not only for the hacking conspiracy but also for unraveling an alleged murder-for-hire plot. Dutch media outlet RTL reported that two murders were planned to take place abroad, with investigative indications pointing to Van der Stap as the individual who issued the orders, though authorities noted there is no indication the plots were ever executed. Furthermore, the Signal logs revealed extensive communications between Van der Stap and Canadian cybersecurity executive Edward Dubrovsky, alongside an executive at a prominent U.S.-based consulting firm. Investigators found that these negotiators frequently received insider details regarding fresh ShinyHunters victims long before the target companies even realized they had been breached. Most alarmingly, federal investigators discovered that Dubrovsky was aware ShinyHunters had successfully stolen sensitive data from FBI servers well before the group publicly threatened to publish the agency’s internal personnel files on social media, yet failed to notify authorities.
On October 9, federal authorities arrested the 54-year-old Dubrovsky in connection with the sprawling investigation. Court records show Dubrovsky, who recently authored a book on managing cyber extortion that advocated for always engaging with digital attackers, has been charged with threatening to disclose hacked data and interfering with interstate commerce through extortion. Federal prosecutors have requested that he remain in custody pending trial, with related court records maintained under seal.
SHINYWIRE
As investigators continued parsing the digital evidence recovered from the international arrests, they turned their attention toward a now-defunct extortion portal known as "shinywire[.]com." Two sources close to the ShinyHunters probe revealed that federal agents believe at least one executive at a prestigious U.S.-based consulting firm with more than 1,000 associates played an active role in operating the website. While authorities have not yet formally charged the individual, investigators have refrained from publicly naming the company or the suspected executive while the probe remains ongoing.
The Shinywire website operated from approximately May 3 until October 16, cataloging nearly 100 organizations that had fallen victim to ShinyHunters data breaches. Each listing functioned as a pressure point, urging corporate victims to open lines of communication with the extortionists and negotiate payment terms. The pages featured samples of stolen proprietary data and explicitly warned that the complete cache of files would be leaked online if the victim failed to meet financial demands within a strict seven-day window. Organizations that refused to engage eventually saw their stolen data published on the primary ShinyHunters shaming blog, which is accessible exclusively through the Tor anonymity network.
Among the corporations listed on the portal was Intuitive Surgical, an American medical technology company that suffered a network breach in March 2026 after an employee fell victim to a targeted phishing campaign that compromised corporate credentials.
The investigation has also brought to light complex personal and professional conflicts within the upper echelons of the cybersecurity industry. Media reports revealed that months prior to his arrest, Dubrovsky had filed a civil lawsuit in Ontario against Daniel Tobok, the former chief executive of Cypfer, a prominent Toronto-founded incident response firm with global offices. Dubrovsky, who served as a managing partner and chief operating officer at Cypfer after the two became business partners in 2017, alleged in court documents that he had become collateral damage in a deliberate campaign by his former partner to destroy him following a business falling-out in 2024. Tobok denied the allegations, filing a counterclaim accusing Dubrovsky of misappropriating confidential information and competing unfairly through another entity called CyberSteward Inc.
GHOSTBYTE
Long before the current wave of indictments, former colleagues alleged that Tobok had ties to ransomware actors dating back roughly eight years under the online moniker "Ghostbyte." In 2018, following an incident where a Canadian company was compromised by Dharma—a prolific Russian-language ransomware affiliate program launched in 2016—the victim sought guarantees that the attackers would honor their word if a ransom was paid. In response, a Dharma representative directed the victim to contact an IT professional using the email address [email protected], telling them that the individual frequently resolved similar extortion dilemmas in Canada.
While it remains unverified whether Tobok actively utilized the Ghostbyte email address provided by the ransomware affiliate, threat-intelligence service Constella Intelligence identified that an email address frequently used by Tobok—[email protected]—was linked to online accounts utilizing the "ghostbyte" username, including a Snapchat profile. Furthermore, Constella traced the Dharma representative’s contact email to a cryptocurrency wallet that processed 38 transactions totaling 43 Bitcoin, valued at approximately $3.5 million at contemporary rates.
Cypfer issued a statement clarifying that its core business operations do not involve making or facilitating ransomware payments. The company stated that it learned of Dubrovsky’s arrest through media reports, had no prior knowledge of the enforcement action, and has not been contacted by law enforcement or targeted in any ongoing investigation. The statement emphasized that CyberSteward and Cypfer operate as entirely separate entities with no shared leadership or personnel. Cypfer was recently acquired by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former chief executive of Aon Cyber Solutions Group. Aon previously acquired Cytelligence, a security firm where Tobok served as founder and CEO and Dubrovsky worked as a managing partner.
CONFLICTING INTERESTS
Under U.S. law, paying a ransom to recover encrypted files or secure a promise to delete stolen data is not inherently illegal, provided the ransomware group is not subject to sanctions by the U.S. Treasury Department. ShinyHunters currently holds no official sanctions designation from the United States or international governments.
Nevertheless, the ecosystem surrounding cyber extortion is fraught with professional and financial conflicts of interest. Insurance providers frequently steer corporate victims toward specific incident response firms. While some forensic companies operate on a flat retainer fee model, others charge a variable percentage of the total ransom paid. Industry experts note that commission-based structures create a profound conflict of interest, financially incentivizing negotiators to facilitate payments and discourage aggressive bargaining that might lower the final payout.
Mark Camillo, chief executive of cyber insurance industry group CyberAcuView, pointed out that the practice of charging a percentage of the ransom transaction undermines objective crisis management. While negotiation firms defend their fees by citing the high operational costs and risks associated with sourcing large volumes of cryptocurrency, Camillo stressed the need for greater transparency to remove misaligned financial incentives from the ecosystem.
Federal prosecutors have increasingly targeted intermediaries who cross the line from remediation into active collusion with cybercriminals. On October 7, the Department of Justice charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy, alleging he charged clients millions for remediation while secretly paying hackers behind their backs. Similarly, in July, Florida ransomware negotiator Angelo Martino was sentenced to 70 months in prison for conspiring with the BlackCat/ALPHV ransomware syndicate to extort corporate victims by secretly passing confidential negotiation strategies to the attackers to maximize extortion payouts.
Leave a Reply