The widening federal probe follows a brazen cyberattack in late September, when hackers aligned with ShinyHunters compromised the FBI’s recruitment portal, fbijobs.gov. The attackers taunted federal law enforcement by threatening to publish a cache of deeply sensitive personnel records stolen from the site. The leaked files reportedly included personal medical and psychological histories, Social Security numbers, home addresses, and detailed information regarding individual employee specializations and organizational units.
The breach of the federal recruitment site catalyzed an aggressive, fast-moving response from the FBI, leading to the rapid detention and questioning of individuals who communicated with key suspects. Among them was a teenage hacker from Amman, Jordan, known online as "Rey," who authorities say assumed administrative control of the ShinyHunters brand after its previous leadership was dismantled. According to the FBI, ShinyHunters has successfully extorted more than $70 million from corporate and institutional victims over the course of the year.
Rey’s rise to power came in the wake of a high-profile international arrest. On the evening of September 15, Dutch authorities apprehended Pepijn van der Stap, a convicted hacker and senior ShinyHunters suspect, during a tactical raid in the Netherlands. Police deployed flash-bang grenades to stun Van der Stap while he remained logged into various active online accounts. According to investigators, the suspect was actively using his Signal instant messaging application at the moment of the raid, giving law enforcement immediate access to recent conversations with frequent contacts, including ransomware negotiators based in Canada and the United States.
Sources with direct knowledge of the investigation revealed that Van der Stap’s encrypted messaging logs provided the critical breakthrough needed to unravel a sinister murder-for-hire plot that surfaced immediately after his apprehension. Dutch media outlet RTL reported last month that two contract murders were planned to take place abroad, with indications pointing to Van der Stap as the person who issued the orders, though authorities noted there is no evidence those plots were ever carried out.
The decrypted communications also exposed deep operational ties to the commercial cybersecurity sector. On October 9, federal authorities arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the ongoing ShinyHunters investigation. Dubrovsky, who recently published a book on cyber extortion management that advised victims to always engage with threat actors, faces federal charges of threatening to disclose stolen data and interfering with interstate commerce through extortion, according to court documents filed in the case. Prosecutors have asked that Dubrovsky remain in custody pending trial, and court records associated with the case have been placed under seal.
Investigators analyzing Van der Stap’s Signal chats discovered that the Dutch hacker maintained frequent contact with Dubrovsky as well as an executive at a prominent U.S.-based consulting firm. According to sources, these executives routinely received details regarding newly compromised ShinyHunters victims even before the targeted organizations themselves realized they had been breached. Most explosively, investigators found evidence indicating that Dubrovsky knew ShinyHunters had successfully stolen sensitive data from FBI servers well before the group publicly threatened to publish the personnel files on social media, yet never alerted the bureau.
SHINYWIRE
As the investigation deepened, federal authorities turned their attention toward an infrastructure component used by the extortionists: a now-defunct website designated as "shinywire[.]com." Sources close to the probe indicate that investigators believe at least one executive at a major U.S.-based consulting firm played an active role in operating the portal. While the U.S. company and the suspected executives have not yet been publicly named or charged with a crime, the firm is described as a prestigious organization with more than 1,000 associates.
The Shinywire portal was active from approximately May 3, 2026, until mid-October, cataloging nearly 100 organizations that had been breached by ShinyHunters. Each listing functioned as a pressure point, urging corporate victims to engage with the cybercriminals to discuss payment terms. The pages featured samples of stolen data alongside warnings that the full cache would be permanently published online if corporate leadership ignored the ransom demands.
Among the targets listed on the site was Intuitive Surgical, an American medical technology company that suffered a network breach in March after an employee fell victim to a targeted phishing campaign. Under the group’s operational model, victim organizations that refused to negotiate within a strict seven-day window found their stolen records dumped onto the primary ShinyHunters shaming blog, which is accessible exclusively via the Tor anonymity network.
The legal and professional fallout surrounding the case has also exposed bitter corporate infighting. Court filings revealed that months prior to his arrest, Dubrovsky filed a lawsuit in Ontario against Daniel Tobok, the former chief executive of Cypfer, a prominent Toronto-founded cybersecurity firm with international offices. The two men originally partnered in 2017 to build Cypfer, where Dubrovsky served as managing partner and chief operating officer. However, the business relationship deteriorated by 2024 amid accusations of marginalization and capricious decision-making. Tobok denied the allegations and filed a counterclaim accusing Dubrovsky of misappropriating confidential information and competing unfairly through a separate venture called CyberSteward Inc.
GHOSTBYTE
Background interviews with former colleagues of Daniel Tobok revealed that years prior to the current controversies, he was known within certain ransomware circles by the alias "Ghostbyte." In 2018, a Canadian company targeted by Dharma—a prolific Russian-language ransomware affiliate program operating since 2016—reported that some of its files were permanently locked and unrecoverable. While the victim expressed a willingness to pay, they sought guarantees that the attackers would honor their word.
In an email reply recovered from the incident, a Dharma representative directed the victim to seek out a specific Canadian IT firm for assurances, recommending contact with an email address registered as [email protected]. The representative noted that the IT company frequently resolved such challenges for Canadian businesses, advising the victim to sign a formal service contract.
While it remains unclear whether Tobok personally utilized the Ghostbyte address, breach intelligence service Constella Intelligence found that an email address frequently used by Tobok—[email protected]—was linked to online accounts registered under the username "ghostbyte," including a Snapchat profile. Furthermore, Constella established a connection between the Dharma representative’s email address and a cryptocurrency wallet that processed dozens of transactions totaling millions of dollars.
Representatives for Cypfer stated that the firm does not facilitate ransomware payments and emphasized that it had no prior knowledge of Dubrovsky’s arrest. The company noted that it has not been contacted by law enforcement and is not the target of any active investigation. Cypfer was recently acquired by Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. Aon previously acquired Cytelligence, a security firm where Tobok served as founder and CEO and Dubrovsky served as managing partner.
CONFLICTING INTERESTS
Under U.S. law, paying a ransom to recover encrypted files or secure promises to delete stolen data is not inherently illegal, provided the threat actors are not designated as sanctioned entities by the U.S. Treasury Department. ShinyHunters does not currently appear on government sanction lists. However, the ecosystem surrounding incident response and ransom negotiation has long faced scrutiny over potential conflicts of interest.
Insurance providers frequently direct victims to specific incident response firms, but divergent corporate policies mean that companies unwilling to facilitate extortion payments are often replaced by entities that face no such ethical qualms. In cases such as the late 2024 extortion of educational technology giant PowerSchool—which saw private data belonging to millions of students and teachers compromised—victims have turned to firms like CyberSteward for negotiation assistance, despite warnings from other security experts.
Leading incident response organizations, including Coveware and Unit 221B, have consistently advised clients against paying ShinyHunters, pointing out that threat actors frequently retain, resell, or weaponize stolen data regardless of whether a ransom is paid. The FBI issued a similar public advisory warning victims against meeting the group’s demands.
Leaked internal communications revealed that the leadership of ShinyHunters viewed Coveware as a major impediment to their financial operations. In private Telegram chats from April and May of 2026, the group’s administrators complained bitterly that Coveware’s public advisories were undercutting their leverage and depressing payment rates, with one message noting that the cybercriminals were actively discussing ways to eliminate the perceived obstacle.
Mark Camillo, chief executive of CyberAcuView, an industry group established by major cyber insurance carriers, noted that pricing models common among some negotiation firms create an inherent conflict of interest. While some companies charge flat retainer fees, others take a percentage of the final ransom payout. Camillo argued that this financial incentive structure encourages negotiators to prioritize completing transactions over driving down costs, calling for greater transparency and visibility into cryptocurrency transaction fees and exchange overhead.
Federal prosecutors have increasingly targeted abusive practices within the negotiation sector. In October, the Department of Justice charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy for allegedly billing clients millions for remediation while secretly paying out lesser ransoms behind their clients’ backs. Similarly, a Florida-based ransomware negotiator was sentenced to prison earlier this year for conspiring with the BlackCat ransomware syndicate to leak confidential client negotiation strategies and maximize extortion payouts.
Leave a Reply