The ShinyHunters brand has loomed large over the cybersecurity landscape since 2019, initially operating as an enterprise driven primarily by cybercriminals located in France. As law enforcement steadily dismantled the original roster through arrests and incarcerations, operational control of the syndicate migrated. Last year, authorities identified "Rey," a teenage hacker based in Amman, Jordan, as the primary administrator steering the group’s modern iteration. According to FBI assessments, ShinyHunters has successfully extorted upward of $70 million from various corporate and governmental victims throughout the current calendar year alone.
The scale of the threat escalated dramatically in late September, when hackers aligned with ShinyHunters breached the FBI’s official recruitment portal, fbijobs.gov. The attackers taunted federal authorities by threatening to publicize a cache of stolen personnel records. Reports indicated the pilfered files contained deeply sensitive information, including medical and psychological evaluations, Social Security numbers, residential addresses, and specific unit assignments and specializations for individual bureau employees.
The brazen breach of a federal law enforcement recruitment site triggered an immediate and aggressive response from the FBI, prompting agents to swiftly detain and question individuals suspected of communicating with Rey or other key affiliates. On October 3, Reuters reported that Jordanian authorities had detained Rey, who subsequently began cooperating with federal investigators.
Rey’s elevation to the head of the syndicate followed the sudden disruption of a senior operational figure. On the evening of September 15, law enforcement officers in the Netherlands executed a high-impact raid in an effort to apprehend Pepijn van der Stap, a convicted hacker and primary suspect in the ShinyHunters investigation. Dutch police utilized flash-bang grenades to stun Van der Stap while he remained actively logged into multiple online accounts.
According to sources familiar with the matter, authorities caught Van der Stap while he was engaged on the Signal instant messaging platform. This tactical advantage granted investigators real-time access to his recent communications channels, exposing frequent dialogues with external ransomware negotiators based in both Canada and the United States. Furthermore, sources indicated that Van der Stap’s decrypted Signal messages became the critical pivot point for unraveling a separate murder-for-hire plot that surfaced immediately in the wake of his apprehension. Dutch media outlet RTL reported last month that two foreign murders were allegedly ordered, with strong indications pointing toward Van der Stap as the orchestrator, though investigators found no evidence that the plots were ultimately executed.
The digital trail left on Van der Stap’s devices quickly yielded high-profile arrests. On October 9, federal authorities arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the broader ShinyHunters probe. Dubrovsky, who had recently published a book on navigating cyber extortion that advocated for open dialogue with threat actors, faces federal charges including threatening to disclose hacked data and interfering with interstate commerce through extortion, court records show. Prosecutors have formally requested that Dubrovsky remain detained pending trial, and court filings associated with the case have been placed under seal.
Investigators analyzing Van der Stap’s Signal archive discovered that the Dutch hacker maintained a steady dialogue with Dubrovsky and at least one executive at a major U.S.-based consulting firm. Troublingly, these messages revealed that the executives frequently possessed insider knowledge regarding newly compromised ShinyHunters victims long before the victim organizations themselves became aware of the breaches.
Even more damaging to Dubrovsky, investigators uncovered evidence demonstrating that the Canadian executive was fully aware that ShinyHunters had successfully exfiltrated sensitive data from FBI servers. Despite this knowledge, Dubrovsky never alerted the bureau prior to the syndicate’s public threats on social media to release the agency’s confidential personnel files.
SHINYWIRE
As the probe deepened, investigators turned their attention toward a defunct extortion portal known as "shinywire[.]com." Two sources close to the investigation revealed that federal agents believe at least one executive at a prominent U.S. consulting firm played an active role in managing the site. While the firm employs more than 1,000 professionals, investigators have withheld the names of the company and the suspected executive pending formal criminal charges.
Operating from approximately May 3 until October 16, the Shinywire platform indexed nearly 100 corporate and institutional entities targeted by ShinyHunters. Each listing functioned as a pressure point, urging victims to open channels with the cybercrime collective to negotiate payment terms. The web pages featured verifiable samples of stolen files and warned that the complete data sets would be published online if demands were ignored.
Cached records from monitoring services like urlscan.io highlighted listings such as one targeting Intuitive Surgical, a U.S. medical technology firm breached in March following a targeted phishing campaign that compromised employee credentials. Under the syndicate’s operational model, victim organizations that failed to initiate contact within a seven-day window found their proprietary data dumped publicly on the group’s primary shaming blog, accessible solely via the Tor anonymity network.
The widening fallout also exposed pre-existing professional rifts within the executive ranks of the cybersecurity industry. In mid-October, The Globe and Mail reported that Dubrovsky had filed a lawsuit in Ontario earlier in the year against Daniel Tobok, the former chief executive of Cypfer, a prominent cybersecurity firm with international operations. Dubrovsky alleged that he had been made collateral damage in a campaign by his former business partner to undermine his professional standing.
The two had established Cypfer together in 2017 after partnering years prior, with Dubrovsky serving as managing partner and chief operating officer. However, relations deteriorated by 2024, leading Dubrovsky to accuse Tobok of freezing him out of business decisions. Tobok denied the allegations and filed a counterclaim accusing Dubrovsky of misappropriating confidential information, competing unfairly through another entity named CyberSteward Inc., and misrepresenting his ownership stake.
GHOSTBYTE
Interviews with former associates of Daniel Tobok revealed that years prior, he was known within specific ransomware circles by the digital moniker "Ghostbyte." In 2018, a Canadian company compromised by Dharma—a prolific Russian-language ransomware affiliate program active since 2016—reported difficulties recovering encrypted files. Seeking assurance that the cybercriminals would honor an agreement if a ransom was paid, the victim received a referral directly from a Dharma representative.
A redacted copy of the correspondence instructed the victim to contact an IT professional in Canada who specialized in resolving such matters, providing the email address [email protected]. The Dharma representative assured the victim that contracting the designated IT company would secure the necessary guarantees, though payment would still be required.
While it remains unproven whether Tobok actively utilized the Ghostbyte address, breach intelligence tracking via Constella Intelligence identified that a personal email address frequently used by Tobok—[email protected]—was linked to online accounts registered under the username "ghostbyte," including a Snapchat profile. Furthermore, Constella connected the Dharma representative’s email address to a cryptocurrency wallet that processed dozens of transactions totaling roughly 43 bitcoin, valued at approximately $3.5 million today.
In a formal statement, Cypfer maintained that its operational mandate strictly excludes facilitating ransomware payments and asserted that the firm had no prior knowledge of Dubrovsky’s arrest before media reports surfaced. The company emphasized that it had received no outreach from law enforcement and was not the target of any active investigation. The statement noted that Cypfer and CyberSteward operate as distinct corporate entities without shared leadership, and highlighted Cypfer’s recent acquisition by the Apros Group, a holding firm led by former FBI special agent Jason Hogg. Aon had previously acquired Cytelligence, a security firm where Tobok served as founder and CEO and Dubrovsky as managing partner.
CONFLICTING INTERESTS
Under U.S. federal law, paying a ransom to recover encryption keys or secure promises of data deletion is not inherently illegal, provided the targeted threat group is not officially designated as a sanctioned entity by the U.S. Treasury Department. ShinyHunters currently holds no such sanction status from governments worldwide.
Insurance providers frequently direct corporate victims to specific incident response firms during a cyber crisis. However, corporate philosophies regarding extortion payments vary widely. Firms that refuse to facilitate ransom payments are frequently dismissed by desperate clients in favor of counterparts willing to negotiate with threat actors.
The financial structures underpinning some negotiation practices have increasingly drawn scrutiny from regulators and industry veterans. In December 2024, ShinyHunters compromised educational technology provider PowerSchool, exfiltrating records belonging to millions of students and teachers across North America. PowerSchool ultimately paid a $2.85 million ransom with the assistance of CyberSteward—an extortion effort that led to a four-year prison sentence for 20-year-old affiliate Matthew Lane.
Despite the payment, the compromised data resurfaced months later when individual school districts received independent extortion demands utilizing the same stolen files. Industry leaders continue to warn that paying extortionists provides zero technical guarantees that data has actually been destroyed or that secondary actors will not exploit the same repository.
Major incident response firms such as Coveware and Unit 221B have consistently advised clients against paying ShinyHunters, pointing out that exfiltrated records are routinely retained, resold, or weaponized directly against a victim’s downstream clientele. The FBI reinforced this stance in a May public advisory.
Internal communications recovered from ShinyHunters’ Telegram channels highlighted the syndicate’s mounting frustration over this counter-extortion advice. In private chats from April and May, group administrators complained bitterly that Coveware’s public guidance was severely depressing their payment rates, prompting operators to discuss ways to "eliminate the problem." Coveware declined to comment on the intercepted communications.
Mark Camillo, chief executive of cyber insurance industry group CyberAcuView, pointed out an inherent conflict of interest within the negotiation ecosystem. While some firms charge fixed retainers, others operate on contingency models tied directly to the final payout figure, incentivizing negotiators to push for higher settlements rather than driving costs down.
Recent federal prosecutions highlight the Department of Justice’s intensifying crackdown on compromised intermediaries. On October 7, federal prosecutors charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy, alleging he charged corporate clients millions for remediation while secretly paying hackers a fraction of the cost behind his clients’ backs. Similarly, in July, Florida-based ransomware negotiator Angelo Martino was sentenced to 70 months in prison for conspiring with the Blackcat/ALPHV syndicate to extract maximum payouts from victim organizations by leaking confidential negotiation strategies directly to the hackers.
Leave a Reply