U.S. federal investigators probing the prolific cybercrime syndicate known as ShinyHunters have uncovered an alarming nexus between the extortion group and senior executives at prominent ransomware negotiation firms. The investigation, which intensified following a high-profile breach of the FBI’s recruitment portal, has revealed that certain industry insiders maintained unusually close relationships with the hackers, with one U.S.-based executive even allegedly helping operate a pressure website designed to coerce victims into paying ransoms.
The findings cast a harsh light on the shadowy ecosystem of cyber extortion response, where intermediaries are hired to mediate crises but, according to federal authorities, may sometimes cross the line into active collaboration.
The Evolution of ShinyHunters and the FBI Breach
Hackers aligned with ShinyHunters have claimed responsibility for dozens of major data breaches since the group first emerged in 2019. In its early days, the operation was primarily run by cybercriminals residing in France. However, as law enforcement agencies systematically identified, arrested, and jailed those original members one by one, control over the ShinyHunters brand eventually shifted. Last year, investigators identified "Rey," a teenage hacker operating out of Amman, Jordan, as the new administrator of the sprawling cybercrime network. According to FBI estimates, ShinyHunters and its associates have successfully extorted more than $70 million from corporate and institutional victims this year alone.
The group’s brazen tactics reached a critical turning point in late September, when hackers breached the FBI recruitment website, fbijobs.gov. To taunt federal authorities, the cybercriminals threatened to publish a trove of deeply sensitive stolen files. The leaked data reportedly included medical and psychological records, Social Security numbers, home addresses, and detailed information regarding the individual specializations and units of bureau employees.
The brazen compromise of an FBI-affiliated portal prompted the bureau to move with extraordinary speed. Authorities rushed to arrest, detain, and interrogate anyone suspected of communicating with Rey or other key suspects within the ShinyHunters network. Reuters reported on October 3 that Rey had been detained by Jordanian authorities and was actively cooperating with the FBI.
Rey’s consolidation of power over the hacking group had been made possible only weeks earlier, following the abrupt neutralization of a senior co-conspirator. On the evening of September 15, law enforcement officers in the Netherlands executed a high-impact raid, using flash-bang grenades to stun and apprehend Pepijn van der Stap, a convicted hacker and prime suspect in the ShinyHunters investigation, while he was actively logged into his various online accounts.
According to sources close to the investigation, Dutch police arrested Van der Stap while he was utilizing the Signal instant messaging application. This tactical timing allowed investigators to immediately preserve and review his recent digital communications, which included extensive correspondence with ransomware negotiators based in both Canada and the United States.
Multiple sources with direct knowledge of the matter revealed that Van der Stap’s decrypted Signal messages proved critical in unraveling a separate, chilling plot. The messages allegedly pointed to a murder-for-hire conspiracy that emerged immediately following his arrest. Dutch news outlet RTL reported last month that two murders were planned to be executed abroad, with indications pointing toward Van der Stap as the individual who issued the orders, though law enforcement confirmed there is no evidence those plots were ever carried out.
The digital trail left on Van der Stap’s devices also led directly to the doorstep of the professional cybersecurity community. On October 9, federal authorities arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the ongoing ShinyHunters investigation. Dubrovsky, who had recently authored a book on handling cyber extortion that strongly advocated for always engaging with hackers, was formally charged in U.S. federal court with threatening to disclose hacked data and interfering with interstate commerce through extortion, court records show. Politico reported that prosecutors have requested Dubrovsky remain in custody pending trial, and that case-related records have been placed under seal.
Investigators reviewing Van der Stap’s messaging logs discovered that the Dutch hacker communicated frequently with Dubrovsky and at least one executive at a major U.S.-based consulting firm. Remarkably, these executives often possessed intimate details regarding newly compromised ShinyHunters victims before the targeted organizations themselves even realized a breach had occurred. Furthermore, federal investigators uncovered evidence indicating that Dubrovsky was fully aware that ShinyHunters had exfiltrated highly sensitive data from FBI servers. Despite this knowledge, he allegedly never notified the bureau prior to the hackers publicly threatening to publish the agency’s confidential personnel files on social media platforms.
SHINYWIRE
As the probe widened, federal investigators uncovered an even more direct operational link between consultants and the cybercriminals. Sources close to the investigation revealed that the FBI believes at least one executive at a prominent U.S.-based consulting firm played an active, hands-on role in operating "shinywire[.]com," a now-defunct extortion portal utilized by ShinyHunters.
While investigators have identified the firm—a prestigious organization with more than 1,000 associates—authorities have not yet publicly named the company or the suspected executive, as formal criminal charges have not yet been filed.
The Shinywire website operated from approximately May 3 until October 16, listing nearly 100 corporate and institutional victims targeted by ShinyHunters. Each listing served as an aggressive pressure tactic, urging victim organizations to open negotiations and discuss payment terms. The pages featured samples of the stolen data, explicitly warning that the complete files would be leaked online if demands were ignored.
Cached internet records captured listings such as one targeting Intuitive Surgical, an American medical technology company that suffered a breach in March after an employee fell victim to a targeted phishing email. Under the mechanics of the scheme, victim organizations that refused to engage or negotiate within a strict seven-day window found all of their exfiltrated data dumped onto the ShinyHunters primary shaming blog, which is accessible exclusively via the Tor anonymity network.
The fallout from these arrests has sent shockwaves through the cybersecurity and legal sectors. In mid-October, The Globe and Mail reported that months prior to his arrest, Dubrovsky had filed a civil lawsuit in Ontario against Daniel Tobok, the former chief executive of Cypfer, a prominent cybersecurity firm founded in Toronto with international offices. Dubrovsky and Tobok had been business partners since 2017, eventually building Cypfer together where Dubrovsky served as managing partner and chief operating officer. However, by 2024, their relationship deteriorated. Dubrovsky claimed Tobok gradually marginalized him from business decisions, leading to a bitter falling out. Tobok denied the allegations, filing a counterclaim accusing Dubrovsky of accessing confidential information and competing unfairly through another entity named CyberSteward Inc., while disputing Dubrovsky’s claim to being a company founder.
GHOSTBYTE
Background inquiries into Daniel Tobok by former colleagues revealed that years prior, the executive was known within certain ransomware circles by the digital moniker "Ghostbyte." Industry records indicate that in 2018, a Canadian company targeted by Dharma—a prolific Russian-language ransomware affiliate program active since 2016—sought assurances that the hackers would honor their word if a ransom was paid for locked files. In an email exchange, a Dharma representative explicitly directed the victim to contact an IT professional associated with the email address [email protected], noting that the individual frequently resolved similar extortion dilemmas in Canada.
While it remains unclear whether Tobok personally utilized the Ghostbyte address provided by the ransomware operators, digital intelligence firm Constella Intelligence found that an email address frequently used by Tobok, [email protected], was historically linked to online accounts—including Snapchat—that utilized "ghostbyte" as a username. Additionally, blockchain analysis revealed that the cryptocurrency wallet associated with the Dharma representative’s email address processed substantial transactions totaling tens of bitcoins during that era.
In official statements released in mid-October, Cypfer distanced itself from the unfolding scandal, stating that the company’s business model does not involve making or facilitating ransom payments, and asserting that leadership learned of Dubrovsky’s arrest through media reports. The company emphasized that it had received no outreach from law enforcement and was not the target of any ongoing investigation. Furthermore, Cypfer noted that it operates entirely separate from CyberSteward, sharing no common directors or officers, following its recent acquisition by the Apros Group, a holding company led by former FBI special agent Jason Hogg.
CONFLICTING INTERESTS
The unfolding legal cases have cast a harsh spotlight on the financial incentives driving the cyber incident response industry. Under United States law, it is not inherently illegal for victimized organizations to pay a ransom in exchange for an encryption key or a promise to delete stolen data, provided the hackers are not affiliated with groups designated as terrorist organizations or sanctioned by the U.S. Treasury Department. Because ShinyHunters is not currently subject to government sanctions, direct payments remain legally permissible, though strongly discouraged by law enforcement.
When cyberattacks strike, insurance providers typically direct victims to specific incident response firms. However, philosophical divisions run deep within the industry. While some reputable firms refuse to facilitate extortion payments, arguing that doing so only fuels further crimes and offers no guarantee of data destruction, other specialized firms routinely mediate these transactions.
This dynamic was glaringly evident in the massive ShinyHunters extortion campaign against education technology provider PowerSchool, which began in late 2024. After hackers stole private data belonging to tens of millions of students and teachers across the U.S. and Canada, PowerSchool reportedly paid a $2.85 million ransom. Documentation related to the incident indicated that the company was assisted in its response by CyberSteward. Despite the payment, the security promise proved illusory; by May 2025, individual school districts began receiving independent ransom demands utilizing samples of the exact same stolen records.
Leading digital forensics firms, including Coveware and Unit 221B, have consistently warned corporations against paying ShinyHunters, pointing out that extorted data is frequently retained, resold, or weaponized directly against a company’s clients. The FBI echoed these warnings in an official public service announcement on May 15, strongly advising against capitulating to the group’s demands.
Internal communications reviewed by investigators show that ShinyHunters leadership grew intensely frustrated by this corporate resistance. Private Telegram chats from May 2026 captured the group’s main account complaining bitterly to a co-conspirator that Coveware’s public advisories were severely harming their payout rates. The hackers lamented that many victims would have paid had they not listened to Coveware’s guidance, going so far as to discuss efforts to "eliminate the problem" posed by the security firm. Coveware declined to comment on the threats.
Industry experts argue that the fee structures utilized by some ransom negotiators create an inherent conflict of interest. Mark Camillo, chief executive of CyberAcuView—an industry group established by major cyber insurance carriers—noted that while some firms charge flat retainers, others take a percentage of the total ransom paid. This financial model incentivizes intermediaries to advocate for higher payouts and discourages aggressive negotiation to lower the ransom amount.
"It has come to the industry’s attention that many of the ransomware payers charge a percentage of the final payment which may or may not be disclosed," Camillo said, emphasizing the need for greater transparency across the ecosystem to eliminate misaligned financial incentives.
Federal prosecutors have increasingly targeted intermediaries who abuse their positions. On October 7, the Department of Justice charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy, alleging he charged customers millions for technical remediation while secretly paying ransomware groups behind his clients’ backs. Similarly, in July, a Florida-based ransomware negotiator named Angelo Martino was sentenced to 70 months in prison for conspiring with the BlackCat/ALPHV ransomware group to extort victims by leaking confidential negotiation strategies to the cybercriminals.
Comments (0)