U.S. federal investigators probing the prolific ShinyHunters cybercrime syndicate—which recently executed a high-profile breach of the FBI—have identified executives at two separate ransomware negotiation firms who maintained unusually close and collusive relationships with the extortion group. According to sources close to the ongoing federal probe, one of these U.S.-based executives allegedly went beyond mere consultation, actively helping ShinyHunters operate a dedicated pressure website designed to coerce victims into meeting exorbitant ransom demands.
Hackers aligned with the ShinyHunters banner have claimed responsibility for dozens of major corporate and institutional data breaches since 2019. The group originally operated primarily out of France, but as law enforcement dismantled the core membership through a series of arrests and jail sentences, control of the brand eventually shifted. Last year, investigators identified "Rey," a teenage hacker based in Amman, Jordan, as the primary administrator steering the group’s operations. According to figures cited by the FBI, ShinyHunters has successfully extorted more than $70 million from victims globally over the course of the year.
The group’s escalating campaign culminated in late September when ShinyHunters compromised the FBI recruitment portal, fbijobs.gov. In a brazen taunt, the hackers threatened to release a trove of sensitive internal files, reportedly containing medical and psychological records, Social Security numbers, home addresses, and detailed assignments regarding employee units and specializations.
The compromise of the bureau’s jobs site triggered an aggressive, rapid-fire response from federal law enforcement, leading to the rapid detention and questioning of individuals who had maintained communications with Rey or other key suspects. Notably, Reuters reported that Rey had been detained by Jordanian authorities and was actively cooperating with federal investigators.
Rey’s ascent to control over the hacking group followed the sudden incapacitation of a senior confederate. On the evening of September 15, Dutch authorities executed a dramatic raid, deploying flash-bang grenades to stun and apprehend convicted hacker and ShinyHunters suspect Pepijn van der Stap as he sat actively logged into multiple online accounts.
According to sources close to the investigation, the raid caught Van der Stap while he was actively using his Signal instant messaging application. This tactical timing enabled law enforcement to capture a live digital trail of recent communications with frequent contacts, including ransomware negotiators stationed in Canada and the United States.
Multiple knowledgeable sources indicated that Van der Stap’s recovered Signal messages provided the critical breakthrough needed to unravel a concurrent murder-for-hire plot that surfaced immediately following his apprehension. The Dutch news outlet RTL reported that the plot involved two murders allegedly planned to be carried out abroad, with investigators finding indications that Van der Stap issued the orders for the attacks, though there is no evidence the plots were ever executed.
The widening net soon ensnared figures in the corporate cybersecurity ecosystem. On October 9, federal authorities arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the sprawling ShinyHunters investigation. Dubrovsky, who recently authored a book on cyber extortion management that advocated for engaging with threat actors, faces federal charges including threatening to disclose hacked data and interfering with interstate commerce through extortion, according to court documents. Politico reported that prosecutors urged the court to keep Dubrovsky detained pending trial and requested that case files remain under seal.
Investigators analyzing Van der Stap’s encrypted messaging logs discovered that the Dutch suspect maintained frequent, direct lines of communication with Dubrovsky as well as an executive at a prominent U.S.-based consulting firm. According to an investigative source, these executives routinely possessed detailed intelligence regarding fresh ShinyHunters victims even before the targeted organizations themselves discovered they had been breached.
Perhaps most explosively, the analysis of Van der Stap’s chat logs revealed that Dubrovsky was fully aware that ShinyHunters had exfiltrated highly sensitive data from FBI servers. Despite this knowledge, Dubrovsky never alerted the bureau prior to the hackers publicizing their breach on social media platforms and threatening to leak deeply personal personnel files.
SHINYWIRE
As the investigation deepened, sources close to the probe revealed that FBI analysts believe at least one executive at a major U.S. consulting firm played an active operational role in running shinywire[.]com, a now-defunct victim extortion portal tied to ShinyHunters. While investigators have identified the firm—a prestigious organization with a workforce exceeding 1,000 associates—news organizations have withheld naming the company or the specific executive pending formal criminal charges.
The Shinywire platform remained active from early May until mid-October, cataloging nearly 100 corporate and institutional entities compromised by ShinyHunters. Each listing functioned as a pressure point, urging victim organizations to initiate contact with the cybercrime syndicate to negotiate payment terms. The pages featured genuine samples of stolen files alongside explicit warnings that the full data caches would be publicly released if victims ignored the extortion demands.
Among the listed entities was Intuitive Surgical, an American medical technology firm breached after an employee fell victim to a targeted phishing email. Under the group’s operational model, if victim organizations refused to engage or negotiate within a strict seven-day window, their stolen proprietary data was systematically published on the primary ShinyHunters shaming blog, which is accessible exclusively via the Tor anonymity network.
The legal and professional fallout has begun fracturing corporate relationships within the industry. Reports indicate that months prior to his arrest, Dubrovsky filed a lawsuit in Ontario against Daniel Tobok, the former chief executive of Cypfer, a Toronto-founded cybersecurity firm with an international footprint spanning the United States, Britain, the Netherlands, the United Arab Emirates, and Mexico.
Dubrovsky and Tobok initially partnered in 2017 to build Cypfer, where Dubrovsky served as managing partner and chief operating officer. However, by 2024, their relationship deteriorated. Dubrovsky alleged in court documents that Tobok gradually marginalized him from core business matters and made increasingly erratic executive decisions. Tobok denied the allegations and filed a counterclaim accusing Dubrovsky of misappropriating confidential information, competing unfairly through another entity called CyberSteward Inc., and misrepresenting his status as a firm founder when he held no equity share.
GHOSTBYTE
Interviews with former colleagues of Daniel Tobok revealed that dating back approximately eight years, he was known among ransomware purveyors by a specific moniker: Ghostbyte. In 2018, a Canadian enterprise fell victim to an intrusion by Dharma, a prolific Russian-language ransomware affiliate program active since 2016. Facing unrecoverable encrypted files, the victim pressed the Dharma representative for guarantees that the criminal group would honor any decryption agreement if paid.
A redacted copy of the extortionist’s reply instructed the victim to contact an IT professional in Canada who specialized in resolving such incidents, specifically directing them to the email address [email protected]. The Dharma representative advised the victim to establish a formal service contract with the individual behind the address, assuring them that the intermediary routinely handled such matters in Canada.
While it remains unconfirmed whether Tobok actively utilized the Ghostbyte address referenced in the correspondence, digital intelligence firm Constella Intelligence uncovered a notable connection. An email address frequently used by Tobok—[email protected]—was tied to multiple online accounts utilizing the username "ghostbyte," including a Snapchat profile. Furthermore, Constella linked the Dharma representative’s email address to a cryptocurrency wallet that processed dozens of Bitcoin transactions valued at approximately $3.5 million.
Cypfer issued a formal statement distancing itself from the unfolding scandal, asserting that the firm’s commercial activities do not include facilitating ransomware payments. Cypfer representatives stated they had no advance knowledge of Dubrovsky’s arrest and confirmed they have not been contacted by law enforcement regarding any ongoing investigation.
The statement emphasized that Cypfer and CyberSteward operate as distinct corporate entities with entirely separate leadership structures. Cypfer was recently acquired by the Apros Group, a holding company headed by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. Aon previously acquired Cytelligence, a security consulting firm founded by Tobok, where Dubrovsky also served as a managing partner.
CONFLICTING INTERESTS
Under U.S. law, paying a ransom to obtain an encryption key or secure a promise to delete stolen data is not inherently illegal, provided the threat actor is not designated under sanctions by the U.S. Treasury Department. Because ShinyHunters currently lacks formal state-level sanctions, transactions with the group exist in a regulatory gray area.
Victim organizations typically rely on cyber insurance providers to direct them to incident response specialists. However, philosophical divisions run deep within the incident response community. While some firms refuse to facilitate extortion payments as a matter of policy, others readily step in when clients decide to pay, creating a revolving door in the marketplace.
For instance, educational technology giant PowerSchool suffered a massive breach in late 2024 when ShinyHunters exfiltrated private data belonging to millions of students and teachers across the United States and Canada. Although PowerSchool reportedly paid a $2.85 million ransom with assistance from CyberSteward, the payment failed to prevent secondary extortion attempts. By May of the following year, individual school districts began receiving direct extortion demands utilizing the exact same stolen datasets.
Leading incident response firms such as Coveware and Unit 221B have consistently advised corporate clients against paying ShinyHunters, warning that cybercriminals rarely destroy exfiltrated data, frequently reselling it or using it for secondary leverage. This hardline stance drew intense ire from the hacking group.
Private Telegram chats reviewed by investigators revealed that ShinyHunters leaders explicitly identified Coveware as a primary obstacle to their profitability. In May messages to a co-conspirator, the main ShinyHunters account lamented that victim hesitation was driven entirely by Coveware’s advisory warnings, complaining that the firm was actively subverting their extortion revenue and discussing efforts to eliminate the perceived problem.
Industry veterans have long pointed out structural conflicts of interest inherent in the ransomware negotiation business. Mark Camillo, CEO of cyber insurance industry group CyberAcuView, noted that while some firms charge flat retainers, others derive compensation through a percentage of the total ransom negotiated and paid.
"It has come to the industry’s attention that many of the ransomware payers charge a percentage of the final payment which may or may not be disclosed," Camillo observed. "This makes no sense if they are also the negotiator. There needs to be more transparency in the process as no one in the ecosystem should be profiting purely on the size of the ransomware transaction or payment itself."
Federal prosecutors have increasingly targeted intermediaries accused of betraying their clients. On October 7, the Department of Justice charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy, alleging he charged clients millions for remediation while secretly paying out lesser sums to hackers behind their backs. Similarly, in July, Florida-based ransomware negotiator Angelo Martino was sentenced to 70 months in prison for conspiring with the Blackcat/ALPHV syndicate to extract maximum payments by leaking his clients’ confidential negotiating strategies directly to the threat actors.
Leave a Reply