U.S. federal investigators probing the notorious ShinyHunters hacking group—which recently compromised sensitive FBI infrastructure—have uncovered alarming ties within the cybersecurity and ransomware negotiation industry. According to sources close to the ongoing investigation, authorities have identified executives at two distinct ransomware negotiation firms who maintained unusually close and illicit relationships with the extortion syndicate. In an even more startling development, investigators believe one of these executives, based in the United States, actively helped ShinyHunters operate a dedicated pressure website designed to coerce victims into paying ransoms.
The revelations underscore a growing, highly lucrative shadow economy where the boundaries between corporate incident response and cybercriminal enterprise have become disturbingly blurred.
Hackers aligned with the ShinyHunters banner have claimed responsibility for dozens of major data breaches dating back to 2019. During its early operations, the group was primarily run by cybercriminals operating out of France. As law enforcement steadily dismantled the original core through arrests and extraditions, control over the ShinyHunters brand eventually shifted to "Rey," an administrator identified last year as a teenage hacker residing in Amman, Jordan. According to official FBI estimates, ShinyHunters has successfully extorted more than $70 million from victims globally this year alone.
The syndicate’s brazen tactics reached a critical inflection point in late September, when hackers tied to ShinyHunters compromised the FBI recruitment website, fbijobs.gov. The attackers taunted federal law enforcement by threatening to publish a trove of stolen files. Reportedly, the compromised data included deeply sensitive personnel records, encompassing medical and psychological files, Social Security numbers, home addresses, and granular details regarding specific employee units and specializations.
The breach of the FBI jobs portal prompted an extraordinarily swift federal response, leading agents to track, detain, and interrogate individuals who maintained any form of communication with Rey or other core ShinyHunters suspects. On October 3, Reuters reported that Rey had been detained by authorities in Jordan and was actively cooperating with federal investigators.
Rey’s rise to power within the group had been facilitated by the abrupt neutralization of a senior co-conspirator. On the evening of September 15, 2026, law enforcement officers in the Netherlands executed a high-stakes tactical raid, arresting convicted hacker and ShinyHunters suspect Pepijn van der Stap. Dutch police reportedly deployed flash-bang grenades to stun Van der Stap as he remained actively logged into various online accounts.
Sources close to the investigation revealed that authorities successfully apprehended Van der Stap while he was utilizing his Signal instant messaging application. This tactical timing granted investigators immediate access to his recent communications history, exposing a direct line to frequent contacts that included ransomware negotiators located in Canada and the United States.
Multiple sources with direct knowledge of the matter indicated that Van der Stap’s decrypted Signal messages became the linchpin in unraveling a chilling murder-for-hire plot that surfaced immediately following his arrest. Dutch news outlet RTL reported last month that two contract killings were allegedly planned to be executed abroad, with investigative indications pointing to Van der Stap as the individual who issued the orders, though law enforcement found no evidence that the attacks were ultimately carried out.
The digital trail left on Van der Stap’s device soon claimed another high-profile scalp. On October 9, federal authorities arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the expanding ShinyHunters probe. Dubrovsky, who recently authored a published book on handling cyber extortion that strongly advocated for always engaging with hackers, now faces federal charges of threatening to disclose stolen data and interfering with interstate commerce through extortion, according to court documents filed in the docket. Prosecutors have formally requested that Dubrovsky remain in custody pending trial, and court records pertaining to his case remain heavily sealed.
Investigators analyzing Van der Stap’s Signal chats discovered a continuous stream of dialogue between the Dutch hacker, Dubrovsky, and at least one executive at a major U.S.-based consulting firm. According to sources familiar with the findings, these executives frequently possessed intimate details regarding newly compromised ShinyHunters victims long before the victim organizations themselves had even detected or confirmed the breaches.
Perhaps most explosively, federal investigators uncovered evidence showing that Dubrovsky was fully aware that ShinyHunters had successfully exfiltrated highly sensitive data from official FBI servers. Despite this knowledge, Dubrovsky never alerted the bureau to the security compromise prior to the syndicate’s public threats on social media platforms to publish the agency’s confidential personnel files.
SHINYWIRE
As the probe expanded, investigators turned their attention to an infrastructure component known as "shinywire[.]com." According to sources close to the probe, the FBI believes at least one executive at a prominent U.S.-based consulting firm played an active, operational role in managing the now-defunct extortion website. While federal authorities have not yet filed formal criminal charges against the executive or the firm—a prestigious organization boasting more than 1,000 associates—law enforcement continues to scrutinize their involvement.
The Shinywire portal operated from approximately May 3, 2026, until October 16, cataloging nearly 100 organizations compromised by ShinyHunters. Each entry on the site functioned as a coercive pressure point, urging victim companies to engage with the cybercrime collective and discuss financial terms. The web pages featured samples of exfiltrated data as proof of the breach, accompanied by explicit warnings that the full trove of files would be permanently published online if corporate leadership ignored the extortion demands.
Among the organizations listed on the cache was Intuitive Surgical, an American medical technology company breached in March 2026 after an employee fell victim to a targeted phishing email attack that compromised corporate credentials. Under the syndicate’s established playbook, victim organizations that refused to negotiate within a strict seven-day window found their stolen files dumped onto the main ShinyHunters victim-shaming blog, which is accessible exclusively via the Tor anonymity network.
The legal fallout surrounding the case has also exposed bitter corporate infighting. Just months prior to his arrest, Edward Dubrovsky filed a lawsuit in Ontario against Daniel Tobok, the former chief executive of Cypfer, a prominent cybersecurity firm founded in Toronto with international offices spanning the U.S., Britain, the Netherlands, the United Arab Emirates, and Mexico. Dubrovsky alleged in court documents that he had been manipulated into becoming collateral damage in a deliberate campaign by his former business partner to destroy another industry executive.
Dubrovsky and Tobok initially became business partners in 2017, later building Cypfer together where Dubrovsky served as managing partner and chief operating officer. However, by 2024, the relationship deteriorated. Dubrovsky accused Tobok of systematically freezing him out of core business decisions and exhibiting increasingly erratic behavior. Tobok vehemently denied the allegations, filing a countersue that accused Dubrovsky of accessing confidential information, competing unfairly through external work at a firm called CyberSteward Inc., and falsely misrepresenting himself as an original founder of Cypfer.
GHOSTBYTE
The investigation into the broader ransomware ecosystem has also brought historical aliases back into focus. Interviews with several former colleagues of Daniel Tobok revealed that as far back as eight years ago, he was known to ransomware purveyors by a specific moniker: "Ghostbyte."
In 2018, a Canadian enterprise fell victim to an intrusion orchestrated by Dharma, a prolific Russian-language ransomware affiliate program active since 2016. When the victim company informed the Dharma representative that they were leaning toward paying the ransom because critical files remained permanently locked and unrecoverable, they requested stronger guarantees that the cybercriminals would honor their word upon payment.
A redacted copy of the cybercriminal’s email reply advised the victim to contact an external IT professional in Canada who specialized in resolving such matters. The Dharma representative specifically directed the target to communicate via the email address [email protected], telling them to sign a service contract with the suggested IT firm to secure transaction guarantees.
While it remains unclear whether Tobok personally utilized the Ghostbyte email address referenced in the Dharma correspondence, digital intelligence firm Constella Intelligence discovered that an email address frequently used by Tobok—[email protected]—was linked to online accounts utilizing the exact username "ghostbyte," including an active Snapchat profile. Furthermore, Constella’s analysis connected the Dharma representative’s fallback email address to a cryptocurrency wallet that processed 38 transactions totaling 43 bitcoin, valued at approximately $3.5 million at contemporary rates.
Cypfer issued a formal corporate statement distancing itself from the unfolding legal drama. Representatives stated that the company’s official business model does not include making or facilitating ransomware payments, and that leadership learned of Dubrovsky’s arrest solely through media reports. The firm emphasized that it had received no outreach from law enforcement and was not the target of any ongoing investigation.
Furthermore, Cypfer noted that CyberSteward operates as an entirely separate entity with no overlapping officers, directors, or employees. Cypfer itself was recently acquired by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. Aon had previously acquired Cytelligence in 2020, a security consulting firm where Tobok served as founder and CEO, and Dubrovsky held the position of managing partner.
CONFLICTING INTERESTS
The legal and ethical frameworks governing ransomware incidents remain complex. In the United States, paying a ransom to obtain an encryption key or secure a promise of data deletion is not explicitly illegal, provided the targeted group is not designated as a sanctioned entity by the U.S. Treasury Department. ShinyHunters currently holds no official sanctions from the U.S. government or international allies.
Nevertheless, the industry is plagued by systemic conflicts of interest. Ransomware victims are frequently directed by cyber insurance providers to specialized incident response firms. However, because not all forensic companies are willing to facilitate extortion payments, clients often cycle through firms until they find negotiators who harbor no ethical objections to paying criminals.
For instance, when education technology giant PowerSchool suffered a massive data breach in December 2024 at the hands of ShinyHunters—exposing private records of 62 million students and 9.5 million teachers across the U.S. and Canada—the company ultimately paid a $2.85 million ransom. Documentation indicates that PowerSchool was assisted in this remediation effort by CyberSteward. (Matthew Lane, a 20-year-old ShinyHunters affiliate from Sterling, Massachusetts, was subsequently sentenced in November 2025 to four years in federal prison for his admitted role in the PowerSchool intrusion).
Despite the payment, the extortion continued. By May 2025, individual school districts began receiving separate ransom demands leveraging samples of the same stolen dataset, highlighting the fundamental reality that ransom payments offer no technical guarantee of data deletion.
Leading incident response firms such as Coveware and Unit 221B have consistently cautioned corporate victims against paying ShinyHunters, publicly warning that exfiltrated data is frequently retained, resold, or weaponized to target clients directly at a later date. The FBI reinforced this guidance in an official public service announcement on May 15, 2026.
Internal communications recovered by investigators demonstrate the extent to which this refusal advice infuriated ShinyHunters leadership. Private Telegram logs from May 2026 reveal the syndicate’s main administrator complaining bitterly to a co-conspirator that Coveware was actively crippling their collection rates. Expressing extreme frustration, the operator wrote that a majority of targeted companies would have paid their demands if not for Coveware’s intervention, adding that they were actively seeking to "eliminate the problem."
Industry experts point out that the financial compensation structures of certain negotiation firms exacerbate these conflicts. Mark Camillo, chief executive of CyberAcuView—an industry group established in 2021 by major cyber insurance carriers—noted that while some firms operate on a flat retainer fee, negotiation specialists frequently charge a percentage of the total ransom paid. This fee structure creates an inherent perverse incentive, aligning the negotiator’s financial windfall directly with the size of the payout.
"It has come to the industry’s attention that many of the ransomware payers charge a percentage of the final payment which may or may not be disclosed," Camillo stated, emphasizing the urgent need for transparency to remove misaligned financial incentives from the ecosystem.
Federal prosecutors have increasingly targeted these abuses within the remediation industry. On October 7, the Department of Justice charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy. Prosecutors allege that Pinhasi charged corporate clients millions for remediation while secretly paying hackers behind the victims’ backs, funneling $8 million to ransomware groups while billing customers $19 million. Similarly, in July, Florida-based ransomware negotiator Angelo Martino was sentenced to 70 months in prison for conspiring with the Blackcat/ALPHV syndicate to extort victims by leaking confidential negotiation strategies to the attackers to maximize ransom yields.
