The revelations come as the international dragnet tightens around ShinyHunters, a prolific cyberextortion brand that has claimed credit for dozens of major data breaches and extorted more than $70 million from victims globally this year alone. Originally operated out of France beginning in 2019, the group experienced leadership churn as its founding members were systematically arrested or jailed. Control of the brand eventually shifted to a teenage hacker based in Amman, Jordan, known online as "Rey," who was identified by authorities last year.
The pressure on the syndicate intensified dramatically following an audacious breach in late September, when hackers aligned with ShinyHunters compromised the FBI recruitment website, fbijobs.gov. The attackers taunted federal law enforcement by threatening to publish sensitive stolen files, which reportedly included home addresses, Social Security numbers, medical and psychological records, and specific details regarding employee units and specializations.
The brazen targeting of the bureau’s hiring portal prompted an immediate and aggressive response from federal investigators, who moved swiftly to detain and question individuals suspected of communicating with Rey and other key suspects. Reuters reported on October 3 that Rey had been detained by Jordanian authorities and was actively cooperating with the FBI.
Rey’s rise to power within the group had been facilitated by the sudden neutralization of a senior member weeks earlier. On the evening of September 15, 2026, Dutch authorities executed a high-stakes arrest in the Netherlands, using flash-bang grenades to stun and apprehend Pepijn van der Stap, a convicted hacker and core ShinyHunters suspect, while he remained logged into his various online accounts.
Law enforcement caught Van der Stap actively using his Signal instant messaging account, granting investigators immediate access to recent communications with frequent contacts, including ransomware negotiators operating in Canada and the United States. Sources with direct knowledge of the investigation revealed that Van der Stap’s decrypted messages served as the crucial thread that unraveled a secondary, alarming plot: an alleged murder-for-hire scheme targeting individuals abroad. Dutch outlet RTL reported last month that two murders were planned and that investigators found indications Van der Stap may have given the orders, though there is no evidence the plots were ever carried out.
The digital footprint left behind on Van der Stap’s messaging application soon snared figures in the legitimate cybersecurity industry. On October 9, KrebsOnSecurity broke the news that the FBI had arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the ongoing ShinyHunters probe. Dubrovsky, who recently authored a book on handling cyber extortion that advised victims to always engage with threat actors, was formally charged in U.S. court with threatening to disclose stolen data and interfering with interstate commerce through extortion. Federal prosecutors subsequently requested that Dubrovsky remain in custody pending trial, with court records placed under seal.
According to investigative sources, Van der Stap’s Signal archive demonstrated that the Dutch hacker maintained frequent contact with Dubrovsky and at least one executive at a major U.S.-based consulting firm. Remarkably, these executives often possessed detailed intelligence regarding fresh ShinyHunters cyberattacks and data thefts before the victimized organizations themselves even realized they had been breached. Furthermore, federal investigators uncovered evidence that Dubrovsky was fully aware that ShinyHunters had compromised highly sensitive FBI servers but failed to notify the bureau before the hackers publicly threatened to release deeply personal personnel files on social media.
SHINYWIRE
As the probe widened, federal investigators uncovered that at least one executive at a U.S.-based consulting firm played an active role in operating "shinywire[.]com," a now-defunct extortion portal utilized by the hackers. While law enforcement has not yet filed formal criminal charges against the individual or the firm—a prestigious company boasting more than 1,000 associates—sources close to the probe confirmed their active participation in the extortion infrastructure.
The Shinywire website operated from approximately May 3, 2026, until October 16, listing nearly 100 organizations compromised by ShinyHunters. Each victim profile on the site exerted pressure on the targeted company to engage with the cybercriminals and negotiate payment terms, frequently displaying samples of stolen files and warning that the complete data cache would be leaked publicly if demands were ignored. Among the cached listings indexed by tracking services was an extortion demand targeting Intuitive Surgical, an American medical technology company that suffered a credential-compromise breach in March 2026 via a targeted phishing email.
Under the group’s extortion model, victim organizations that refused to open a dialogue or negotiate within a seven-day window found their stolen archives dumped onto the ShinyHunters victim-shaming blog, which was accessible only through the anonymity network Tor.
The fallout from the investigation has also exposed bitter corporate infighting within the upper echelons of the cyber incident response industry. In October, The Globe and Mail reported that months prior to his arrest, Edward Dubrovsky had filed a lawsuit in Ontario against Daniel Tobok, the former chief executive of Cypfer, a prominent Toronto-founded cybersecurity firm with international offices. Dubrovsky alleged he had become collateral damage in a campaign by his former business partner to destroy him.
The two men had partnered in 2017 to build Cypfer, where Dubrovsky served as managing partner and chief operating officer. However, by 2024, their relationship deteriorated amid accusations that Tobok was freezing Dubrovsky out of key business decisions. Tobok denied the allegations and filed a counterclaim accusing Dubrovsky of misappropriating confidential information and competing unfairly through a separate venture called CyberSteward Inc., while also disputing Dubrovsky’s claim to being a company founder.
GHOSTBYTE
Long before the current federal indictments, Tobok’s name was whispered in underground circles. Interviews with several of his former colleagues revealed that as far back as eight years ago, he was known to ransomware purveyors by the moniker "Ghostbyte."
The connection surfaced from historical intrusion data. In 2018, a Canadian company fell victim to Dharma, a prolific Russian-language ransomware affiliate program active since 2016. As the victim debated paying the ransom to recover unrecoverable encrypted files, they sought assurances that the hackers would honor their word. In a reply email, a Dharma representative explicitly advised the company to contact an IT professional in Canada, recommending an email address associated with the handle: [email protected].
"If you want guarantees, you can write to the IT company," the Dharma operative wrote to the victim. "Take the phone and negotiate with them. This IT company often solves such problems in Canada. You can contact them and sign a contract for services. You’ll still have to pay."
While it remains unproven whether Tobok actively monitored or utilized the Ghostbyte inbox provided by the cybercriminals, threat intelligence firm Constella Intelligence established that an email address frequently used by Tobok—[email protected]—was linked to two online accounts utilizing the exact same username, including Snapchat. Constella’s analysis also tied the Dharma representative’s email address to a cryptocurrency wallet that processed dozens of transactions worth millions of dollars.
Cypfer issued a statement distancing itself from the unfolding scandal, stating that the firm’s business model does not involve making or facilitating ransomware payments and that it learned of Dubrovsky’s arrest through media reports. The company emphasized that it had no prior knowledge of the arrest, had received no law enforcement outreach, and was not the target of any active government investigation.
Furthermore, Cypfer noted that it operates entirely separate from CyberSteward and that the firm was recently acquired by the Apros Group, a holding company led by former FBI special agent and former Aon Cyber Solutions CEO Jason Hogg. In 2020, Aon had acquired Cytelligence, a security consulting firm where Tobok previously served as CEO and Dubrovsky as managing partner.
While paying ransoms to retrieve encryption keys or secure promises of data deletion is not inherently illegal under U.S. law—provided the target group is not subject to Treasury Department sanctions, a classification ShinyHunters currently avoids—the practice remains a lightning rod for ethical and legal scrutiny. Insurance providers frequently direct breach victims toward specialized incident response firms, but a sharp divide exists within the industry. While some firms refuse to facilitate extortion payments outright, others readily step in when clients decide to pay.
The financial entanglement can run deep. In late 2024, ShinyHunters compromised educational technology provider PowerSchool, stealing private records belonging to tens of millions of students and teachers across the United States and Canada. PowerSchool reportedly paid a $2.85 million ransom with assistance from CyberSteward, a remediation effort that preceded the four-year prison sentence handed down in November 2025 to 20-year-old ShinyHunters affiliate Matthew Lane.
Despite the payment, the settlement failed to halt subsequent extortion attempts. By May 2025, individual school districts began receiving separate ransom demands leveraging samples of the same stolen PowerSchool database, highlighting the futility of relying on a criminal syndicate’s promise to securely delete purloined information.
Leading cyber incident response firms such as Coveware and Unit 221B have consistently warned clients against paying ShinyHunters, pointing out that stolen data is routinely retained, resold, or weaponized to extort customers directly. The FBI reinforced this guidance in a May 2026 public service announcement advising against capitulating to the group’s demands.
The warnings have drawn the ire of ShinyHunters leadership. Internal Telegram chats reviewed by investigators show the group’s main account bitterly complaining that Coveware was actively harming their extortion revenue. In conversations from April and May 2026, the ShinyHunters administrator lamented that victims who otherwise would have paid were refusing to do so because of Coveware’s advice, prompting the syndicate to discuss ways to "eliminate the problem." Coveware declined to comment on the threats.
Industry observers argue that the fee structures employed by certain ransomware negotiators create inherent conflicts of interest. Mark Camillo, CEO of the cyber insurance industry group CyberAcuView, noted that firms charging a percentage of the total ransom transaction are financially incentivized to maximize payouts rather than negotiate them downward.
"It has come to the industry’s attention that many of the ransomware payers charge a percentage of the final payment which may or may not be disclosed," Camillo said, emphasizing the need for greater transparency across the ecosystem to eliminate misaligned financial motives.
Federal prosecutors have increasingly targeted intermediaries who abuse their positions of trust. On October 7, the Department of Justice charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy, alleging he secretly went behind his customers’ backs to pay hackers $8 million while billing clients $19 million for purported remediation work. Similarly, in July, Florida ransomware negotiator Angelo Martino was sentenced to 70 months in prison for conspiring with the Blackcat/ALPHV ransomware group to provide confidential client negotiation strategies that enabled criminals to maximize their extortion demands.
Leave a Reply