The revelations come as law enforcement agencies across multiple continents accelerate their efforts to dismantle the infrastructure and leadership of ShinyHunters. Operating in various iterations since 2019, the group originally gained notoriety under a core collective of cybercriminals based in France. As those early members were systematically apprehended and imprisoned, control of the ShinyHunters brand eventually shifted to a young administrator known online as “Rey,” identified last year as a teenage hacker residing in Amman, Jordan. According to federal estimates, the group has successfully extorted more than $70 million from corporate and public-sector victims so far this year alone.
The scope of the group’s operations drew unprecedented scrutiny in late September, when ShinyHunters breached the official FBI recruitment portal, fbijobs.gov. The hackers brazenly taunted law enforcement by threatening to release a trove of highly sensitive internal documents. The stolen data reportedly included confidential medical and psychological evaluations, Social Security numbers, home addresses, and detailed assignments regarding employee units and specializations.
The security breach at the federal law enforcement agency triggered a swift and aggressive response. Authorities moved quickly to detain, question, and investigate anyone who maintained communications with Rey or his suspected co-conspirators. On October 3, Reuters reported that Rey had been detained by Jordanian authorities and was actively cooperating with the FBI.
Rey’s rise to power within the syndicate followed the sudden neutralization of a key senior member just weeks prior. On the evening of September 15, Dutch law enforcement officials executed a dramatic raid in the Netherlands, arresting convicted hacker and ShinyHunters suspect Pepijn van der Stap. Police reportedly deployed flash-bang grenades to stun Van der Stap while he was actively logged into various online accounts.
According to sources familiar with the investigation, authorities apprehended Van der Stap while he was using his Signal instant messaging account. This tactical advantage allowed investigators immediate access to his recent communications, exposing a network of frequent contacts that included ransomware negotiators based in both Canada and the United States.
Multiple sources with direct knowledge of the matter told KrebsOnSecurity that Van der Stap’s decrypted Signal messages served as the crucial breakthrough in unraveling a separate murder-for-hire plot that surfaced immediately following his arrest. Dutch news outlet RTL reported last month that two contract murders were allegedly planned to be carried out abroad, with investigators finding indications that Van der Stap had issued the orders for the attacks, though there is no evidence those plots were ever executed.
The digital trail left on Van der Stap’s devices soon yielded further arrests. On October 9, federal authorities arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the ongoing ShinyHunters probe. Dubrovsky, who recently authored a book on handling cyber extortion that strongly advocated for maintaining active engagement with threat actors, was formally charged in U.S. federal court with threatening to disclose hacked data and interfering with interstate commerce through extortion. According to Politico, federal prosecutors have asked that Dubrovsky remain in custody pending trial, and court records related to the case have been placed under seal.
Investigators analyzing Van der Stap’s Signal chats discovered that the Dutch hacker maintained frequent communications with Dubrovsky and at least one executive at a major U.S.-based consulting firm. Remarkably, these executives often possessed inside details regarding newly compromised ShinyHunters victims before the victim organizations themselves were even aware they had been breached. Furthermore, federal investigators uncovered evidence indicating that Dubrovsky was fully aware ShinyHunters had exfiltrated highly sensitive personnel files from FBI servers, yet failed to notify the bureau before the hackers publicly threatened to publish the confidential records on social media platforms.
SHINYWIRE
As the investigation deepened, federal authorities uncovered evidence suggesting that at least one executive at a U.S.-based consulting firm played a direct, operational role in managing shinywire[.]com, a now-defunct extortion portal utilized by ShinyHunters. While KrebsOnSecurity has chosen to withhold the names of the U.S. company and the suspected executive pending formal criminal charges, the enterprise is described as a prestigious firm boasting more than 1,000 associates.
The Shinywire platform remained active from approximately May 3 until October 16, cataloging nearly 100 organizations that had fallen victim to ShinyHunters intrusions. Each listing on the site functioned as an aggressive pressure tactic, urging corporate leadership to engage with the cybercriminals to discuss payment terms. The pages featured samples of the stolen data alongside explicit warnings that the full cache would be published online if ransom demands were ignored.
Cached records from monitoring services such as urlscan.io highlight extortion demands directed at high-profile entities, including Intuitive Surgical, an American medical technology company breached in March following a targeted phishing attack that compromised an employee’s credentials. Under the mechanics of the scheme, victimized organizations that failed to engage or negotiate within a strict seven-day window found their stolen intellectual property and internal files permanently leaked on the primary ShinyHunters shaming blog, accessible exclusively via the Tor anonymity network.
The legal fallout surrounding the case has also exposed bitter internal corporate disputes. In mid-October, The Globe and Mail reported that Edward Dubrovsky had filed a lawsuit in Ontario earlier in the year against Daniel Tobok, the former chief executive of Cypfer, a Toronto-founded cybersecurity firm with an international footprint spanning the United States, Britain, the Netherlands, the United Arab Emirates, and Mexico.
Dubrovsky and Tobok initially became business partners in 2017 to build Cypfer, where Dubrovsky served as managing partner and chief operating officer. However, the professional relationship deteriorated by 2024, with Dubrovsky alleging in court documents that Tobok systematically edged him out of corporate decision-making. Tobok denied the allegations and filed a counterclaim accusing Dubrovsky of misappropriating confidential information and competing unfairly through a separate venture called CyberSteward Inc.
GHOSTBYTE
Internal company history and digital forensics have further complicated the corporate web surrounding these firms. Interviews with former colleagues indicate that years prior, Tobok was known within certain ransomware circles by the alias Ghostbyte. In 2018, a Canadian enterprise fell victim to an attack orchestrated by Dharma, a prolific Russian-language ransomware affiliate program. When the victim sought assurances that the attackers would honor their word upon payment, the Dharma representative explicitly directed them to contact an IT professional using the email address [email protected].
While it remains unverified whether Tobok actively used the Ghostbyte address, threat intelligence platform Constella Intelligence established that a primary personal email address frequently utilized by Tobok—[email protected]—was tied to online accounts operating under the username "ghostbyte," including a Snapchat profile. Constella data also linked the Dharma representative’s contact email to a cryptocurrency wallet that processed dozens of transactions totaling millions of dollars.
In response to media inquiries, Cypfer issued a statement clarifying that the company does not engage in facilitating ransomware payments and maintained no prior knowledge of Dubrovsky’s arrest. The firm emphasized that CyberSteward and Cypfer operate as entirely separate entities with no shared leadership or personnel. Cypfer was recently acquired by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. Aon previously acquired Cytelligence, a security consulting firm where Tobok served as founder and CEO and Dubrovsky as managing partner.
CONFLICTING INTERESTS
Under U.S. law, paying a ransom to recover encrypted files or secure promises to delete stolen data is not inherently illegal, provided the extortionist group is not subject to U.S. Treasury Department sanctions. Because ShinyHunters has not been formally designated under federal sanction lists, victim organizations frequently weigh payment against the potential operational fallout of a public data leak.
Corporate victims are typically guided by cyber insurance carriers to retain specific incident response firms. However, industry practices diverge sharply; while some forensics providers refuse to facilitate extortion payments on ethical grounds, others willingly step in when clients decide to pay. This dynamic has drawn intense scrutiny from law enforcement and industry veterans alike.
For instance, when education technology giant PowerSchool suffered a massive breach in late 2024 that compromised the records of over 60 million students and nearly 10 million teachers, the company ultimately paid a $2.85 million ransom. Documentation from the incident indicated that PowerSchool was assisted by CyberSteward during the ordeal. Despite the payment, subsequent waves of extortion targeting individual school districts emerged months later, demonstrating the inherent risk that threat actors frequently retain or monetize stolen data regardless of ransom agreements.
Leading incident response firms, including Coveware and Unit 221B, have consistently advised against paying ShinyHunters, warning that extortionists routinely break promises to delete data. These advisories have placed target firms directly in the crosshairs of the cybercriminals. Internal communications obtained by investigators revealed that ShinyHunters leadership expressed intense frustration toward Coveware for actively advising victims not to pay, complaining that the firm’s guidance severely degraded their extortion revenue and discussing efforts to eliminate the perceived obstacle.
Industry leaders argue that financial structures within the negotiation ecosystem create clear conflicts of interest. Mark Camillo, chief executive of the cyber insurance industry group CyberAcuView, noted that some remediation firms charge contingency fees calculated as a percentage of the final ransom payout. This financial model inherently rewards negotiators for larger transactions, creating misaligned incentives that run contrary to the best interests of victimized clients.
Recent federal prosecutions underscore these systemic vulnerabilities. On October 7, the U.S. Department of Justice charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy, alleging he charged clients millions for remediation while secretly paying hackers behind the scenes. Similarly, a Florida-based ransomware negotiator was sentenced to prison earlier this year for conspiring with the Blackcat/ALPHV syndicate to provide confidential client negotiating strategies to attackers to maximize extortion payouts.
Leave a Reply