U.S. federal investigators probing the notorious ShinyHunters hacking group—which recently executed a high-profile data theft targeting the Federal Bureau of Investigation (FBI)—have identified executives at two separate ransomware negotiation firms who maintained unusually close and illicit relations with the extortion syndicate. According to sources close to the unfolding investigation, one of these U.S.-based executives actively assisted ShinyHunters in operating a dedicated pressure website designed to coerce victims into paying extortion demands.
Hackers aligned with ShinyHunters have claimed responsibility for dozens of major corporate and institutional data breaches since 2019. The collective was initially operated primarily by cybercriminals residing in France. As those founding members were systematically arrested and jailed by international law enforcement, control over the ShinyHunters brand eventually transitioned to "Rey," an administrator identified last year as a teenage hacker based in Amman, Jordan. According to FBI estimates, the group has successfully extorted more than $70 million from corporate and government victims this year alone.
The scope of the group’s operations escalated dramatically in late September, when ShinyHunters compromised the FBI recruitment website, fbijobs.gov. The attackers taunted federal authorities by threatening to publish sensitive stolen files, which reportedly included medical and psychological records, Social Security numbers, home addresses, and detailed information regarding employee specializations and organizational units.
This audacious breach of federal infrastructure prompted the FBI to move with uncommon speed, detaining, arresting, and questioning individuals who maintained any form of communication with Rey or other associated suspects. On October 3, Reuters reported that Rey had been detained by Jordanian authorities and was actively cooperating with federal investigators.
Rey’s rise to administrative control over the hacking group followed the sudden incapacitation of a senior member. On the evening of September 15, 2026, law enforcement authorities in the Netherlands arrested Pepijn van der Stap, a convicted hacker and primary ShinyHunters suspect. Dutch police reportedly deployed flash-bang grenades to stun and apprehend Van der Stap while he was actively logged into various online accounts.
According to sources close to the investigation, police arrested Van der Stap while he was using his Signal instant messaging account, granting authorities immediate access to recent communications with frequent contacts, including ransomware negotiators based in Canada and the United States.
Multiple knowledgeable sources reported that Van der Stap’s recovered Signal messages proved instrumental in unraveling a potential murder-for-hire plot that surfaced immediately following his apprehension. Dutch news outlet RTL reported last month that two planned murders were allegedly scheduled to be executed abroad, with investigators finding indications that Van der Stap issued the orders for the attacks, though there is no evidence indicating the plots were ever carried out.
On October 9, KrebsOnSecurity broke the news that the FBI had arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the widening ShinyHunters probe. Dubrovsky, who recently published a book on handling cyber extortion that advised victims to always engage with hackers, was formally charged with threatening to disclose stolen data and interfering with interstate commerce through extortion, according to federal court records. Politico reported that prosecutors requested Dubrovsky remain in custody pending trial, with case records currently maintained under seal.
A source close to the investigation revealed that Van der Stap’s decrypted Signal chats documented frequent conversations with Dubrovsky and at least one executive at a prominent U.S.-based consulting firm. These communications reportedly demonstrated that the executives often possessed detailed knowledge of newly breached ShinyHunters victims before the victim organizations themselves were even aware of the intrusions.
Furthermore, federal investigators uncovered potentially explosive evidence indicating that Dubrovsky knew ShinyHunters had successfully stolen highly sensitive data from FBI servers. Despite this knowledge, Dubrovsky never informed the bureau of the breach prior to ShinyHunters publicly threatening on social media to release deeply personal personnel files.
SHINYWIRE
Federal investigators believe at least one executive at a U.S.-based consulting firm played an active operational role in managing the now-defunct ShinyHunters victim extortion website, known as shinywire[.]com. While law enforcement has not yet filed formal criminal charges against the individual or the firm, sources indicate the company is a prestigious organization boasting more than 1,000 associates.
The Shinywire portal operated from approximately May 3, 2026, until October 16, listing nearly 100 organizations compromised by ShinyHunters. Each entry on the site pressured victims to open channels with the cybercrime group to discuss payment terms, accompanied by samples of stolen files and explicit warnings that the full data archives would be published online if demands were ignored.
Archived records show the site targeted entities such as Intuitive Surgical, an American medical technology company breached in March 2026 after an employee fell victim to a targeted phishing email campaign that compromised credentials. Victim organizations that refused to engage or negotiate within a strict seven-day window found their stolen data published on the primary ShinyHunters shaming blog, accessible exclusively via the Tor anonymity network.
The legal and professional fallout surrounding these networks has already triggered internal industry warfare. In mid-October, The Globe and Mail reported that months prior to his arrest, Edward Dubrovsky filed a lawsuit in Ontario against Daniel Tobok, the former chief executive of Cypfer—a Toronto-founded cybersecurity firm with international offices. Dubrovsky alleged he had become collateral damage in a bitter campaign by Tobok to destroy a former business partner.
The two had partnered in 2017 to build Cypfer, where Dubrovsky served as a managing partner and chief operating officer. By 2024, however, their relationship deteriorated amid accusations that Tobok was progressively excluding Dubrovsky from business decisions. Tobok denied the allegations and filed a counterclaim accusing Dubrovsky of accessing confidential information and competing unfairly through an alternative venture named CyberSteward Inc., while allegedly misrepresenting his status as a firm founder.
GHOSTBYTE
According to interviews with former colleagues, Tobok had been known within ransomware circles for years by the moniker "Ghostbyte." In 2018, a Canadian company compromised by Dharma—a prolific, Russian-language ransomware affiliate program active since 2016—sought assurances that the hackers would honor data deletion agreements if a ransom was paid.
A redacted copy of the Dharma representative’s email reply directed the victim to contact an IT professional associated with the alias [email protected]. The representative advised the victim that the specified Canadian IT firm frequently resolved such negotiations and that they should sign a service contract.
While it remains unclear whether Tobok actively utilized the Ghostbyte address, breach tracking service Constella Intelligence identified that an email address frequently used by Tobok—[email protected]—was linked to online accounts utilizing the "ghostbyte" username, including Snapchat. Additionally, Constella tied the Dharma representative’s email address to a cryptocurrency wallet that processed dozens of transactions totaling substantial sums.
Cypfer issued a statement clarifying that the company does not facilitate ransomware payments and maintained no prior knowledge of Dubrovsky’s arrest. The firm emphasized that it has received no outreach from law enforcement and is not the subject of any active investigation. Cypfer was recently acquired by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group, which previously acquired Cytelligence, a firm where Tobok served as founder and CEO and Dubrovsky as managing partner.
CONFLICTING INTERESTS
Under U.S. law, paying a ransom to recover encrypted systems or secure promises of data deletion is not inherently illegal, provided the extortionist group is not designated on U.S. Treasury Department sanction lists. ShinyHunters is not currently designated as a sanctioned entity by the United States or allied governments.
Insurance providers frequently direct corporate victims to specific incident response and negotiation firms. However, because some forensics firms refuse to facilitate payments, victim organizations frequently switch to intermediaries willing to negotiate transactions. Furthermore, industry experts note an inherent conflict of interest within the negotiation ecosystem: firms that charge a percentage fee based on the final ransom amount are financially incentivized to maximize payouts rather than negotiate reductions.
Mark Camillo, chief executive of CyberAcuView, an insurance-backed industry group, highlighted the systemic friction. He noted that charging a percentage of the total transaction creates perverse incentives, as negotiators profit directly from the scale of the extortion payment.
Recent federal prosecutions underscore these concerns. On October 7, the Department of Justice charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy for allegedly charging clients millions for remediation while secretly paying hackers behind their clients’ backs. In July, a Florida-based ransomware negotiator was sentenced to 70 months in prison for conspiring with the Blackcat/ALPHV ransomware group to siphon confidential client negotiation strategies and maximize victim payouts.
Leave a Reply