U.S. federal investigators pursuing the notorious ShinyHunters hacking group—which recently compromised sensitive data from the Federal Bureau of Investigation (FBI)—have identified executives at two separate ransomware negotiation firms who maintained unusually close and illicit relations with the extortion syndicate. According to sources close to the unfolding investigation, one of these executives based in the United States actively assisted ShinyHunters in operating a dedicated website designed to pressure corporate victims into paying extortion demands.
Hackers aligned with the ShinyHunters banner have claimed responsibility for dozens of high-profile data breaches since 2019. In its early days, the collective was primarily operated by cybercriminals residing in France. However, as those foundational members were systematically arrested or jailed by international law enforcement, control over the ShinyHunters brand eventually transitioned to an individual known online as “Rey.” Last year, investigators identified Rey as a teenage hacker operating out of Amman, Jordan. According to official FBI assessments, the group has successfully extorted more than $70 million from victims globally over the course of the current year alone.
The scope of the group’s operations escalated dramatically in late September, when ShinyHunters breached the FBI recruitment portal, fbijobs.gov. The hackers brazenly taunted federal law enforcement by threatening to publish the stolen repository of files online. Reports indicate the compromised material included deeply sensitive personnel information, such as medical and psychological records, Social Security numbers, home addresses, and specific details regarding the employment units and specializations of agency employees.
This audacious breach of an FBI recruitment site galvanized the bureau, prompting federal authorities to move with uncommon swiftness to arrest, detain, and question individuals suspected of communicating with Rey or other key members of the hacking collective. Reuters reported on October 3 that Rey had been detained by Jordanian authorities and was actively cooperating with the FBI.
Rey’s consolidation of power over the hacking group followed closely on the heels of another critical law enforcement disruption. On the evening of September 15, authorities in the Netherlands executed a high-impact arrest, taking convicted hacker and ShinyHunters suspect Pepijn van der Stap into custody. Dutch police reportedly deployed flash-bang grenades to stun and apprehend Van der Stap while he remained actively logged into various online accounts.
According to sources close to the ongoing investigation, Dutch authorities apprehended Van der Stap while he was using his Signal instant messaging account. This tactical advantage granted investigators immediate access to his recent communications, revealing a robust network of frequent contacts that included ransomware negotiators based in both Canada and the United States.
Multiple knowledgeable sources indicated that Van der Stap’s decrypted Signal messages became the crucial key to unraveling an even darker plot: a murder-for-hire scheme that surfaced immediately in the wake of his arrest. The Dutch news outlet RTL reported last month that two murders were allegedly planned to be carried out abroad, with early investigative indications suggesting Van der Stap may have issued the orders for the attacks, though there is no indication those plans were ever executed.
On October 9, KrebsOnSecurity broke the news that the FBI had arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the expanding ShinyHunters investigation. Dubrovsky, who recently authored a book on managing cyber extortion that explicitly recommended always engaging with malicious hackers, was formally charged with threatening to disclose stolen data and interfering with interstate commerce through extortion, according to federal court records. Politico reported that prosecutors requested Dubrovsky remain in custody pending trial, and that court records related to the case have been placed under seal.
A source close to the investigation revealed that Van der Stap’s recovered Signal communications demonstrated frequent, direct conversations between the Dutch hacker, Dubrovsky, and at least one executive at a large U.S.-based consulting firm. Troublingly, these executives frequently possessed intimate details regarding new ShinyHunters victims before the victim organizations themselves were even aware they had been breached.
Furthermore, federal investigators uncovered what they describe as a potentially explosive finding: the Dutch hacker’s chat logs showed that Dubrovsky was fully aware ShinyHunters had exfiltrated highly sensitive personnel data from FBI servers. Despite this knowledge, Dubrovsky never informed the bureau of the breach prior to the hackers publicly threatening on social media platforms to release the agency’s deeply personal files.
SHINYWIRE
Investigators exploring the broader perimeter of the ShinyHunters probe have also turned their attention to a now-defunct extortion portal. According to two sources close to the investigation, the FBI believes at least one executive at a prestigious U.S.-based consulting firm played an active role in operating the portal, known as "shinywire[.]com." While KrebsOnSecurity has chosen to withhold the names of the U.S. company and the suspected executive because formal criminal charges have not yet been filed, the firm in question employs more than 1,000 professionals.
The Shinywire website remained active from approximately May 3, 2026, until October 16, displaying entries for nearly 100 corporate and institutional organizations compromised by ShinyHunters. Each listing functioned as a pressure point, urging targeted entities to engage with the cybercrime syndicate to negotiate payment terms. The pages featured samples of the stolen files and explicitly warned that the complete data sets would be published online if victims ignored the extortion demands.
Cached portions of the site cataloged extortion campaigns against major entities, such as Intuitive Surgical, an American medical technology company breached in March 2026 after an employee fell victim to a targeted phishing email campaign that compromised organizational credentials. Under the mechanics of the scheme, victim organizations that refused to negotiate within a strict seven-day window found their stolen data publicly broadcast on the ShinyHunters shaming blog, which is hosted exclusively on the Tor anonymity network.
The widening investigative net has also intersected with pre-existing corporate disputes. In mid-October, The Globe and Mail reported that months prior to his arrest, Edward Dubrovsky had filed a lawsuit in Ontario alleging he had become collateral damage in a personal campaign by a former business partner designed to ruin another industry executive.
The lawsuit targeted Daniel Tobok, the former chief executive of Cypfer, a prominent cybersecurity firm founded in Toronto with international offices spanning the United States, Britain, the Netherlands, the United Arab Emirates, and Mexico. Dubrovsky and Tobok initially became business partners in 2017 to build Cypfer, where Dubrovsky served as managing partner and chief operating officer. However, by 2024, their relationship deteriorated, with Dubrovsky accusing Tobok of gradually freezing him out of core business operations and making increasingly erratic management decisions. Tobok denied these allegations and filed a counterclaim accusing Dubrovsky of accessing confidential information and operating a competing venture, CyberSteward Inc., while falsely representing himself as a Cypfer founder rather than a shareholder.
GHOSTBYTE
The investigation has also brought historical online aliases into the spotlight. Interviews with several former colleagues of Daniel Tobok indicate that as far back as eight years ago, he was known among ransomware purveyors by a specific moniker: "Ghostbyte."
In 2018, a Canadian company fell victim to Dharma, a prolific Russian-language ransomware affiliate program that emerged in 2016. When the victim company informed the Dharma representative that they were considering paying the ransom due to unrecoverable file locks, they requested stronger guarantees that the extortionists would honor their word. In a redacted email reply recovered by investigators, the Dharma representative suggested the victim contact an individual at a Canadian IT firm who frequently handled such guarantees, recommending they email "[email protected]."
"If you want guarantees, you can write to the IT company," the Dharma representative advised the victim. "Take the phone and negotiate with them. This IT company often solves such problems in Canada. You can contact them and sign a contract for services. You’ll still have to pay."
While it remains unclear whether Tobok ever utilized the specific Ghostbyte address provided by the Dharma affiliate, and he has not responded to multiple requests for comment, digital footprint analysis tells a parallel story. According to breach tracking service Constella Intelligence, an email address frequently used by Tobok—[email protected]—is linked to multiple online accounts utilizing the username "ghostbyte," including a Snapchat account. Furthermore, Constella established that the Dharma representative’s email address is associated with a cryptocurrency wallet that processed dozens of transactions totaling substantial sums.
In an official statement released in mid-October, Cypfer emphasized that the company’s operational scope does not involve making or facilitating ransomware payments, and asserted that management learned of Dubrovsky’s arrest through media reports.
"We had no prior knowledge of Mr. Dubrovsky’s arrest," a Cypfer spokesperson stated. "Cypfer has not received any outreach from law enforcement and, to our knowledge, is not the target of any law enforcement investigation." The company added that CyberSteward and Cypfer operate as entirely separate corporate entities with no shared officers, directors, or employees, noting that Cypfer was recently acquired by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. Aon previously acquired Cytelligence, a security consultancy where Tobok served as founder and CEO and Dubrovsky as managing partner.
CONFLICTING INTERESTS
The legal landscape surrounding ransomware payments remains complex. In the United States, it is not strictly illegal to pay hackers for an encryption key or in exchange for a promise to delete stolen files, provided the extortionist group is not designated as a sanctioned entity by the U.S. Treasury Department. ShinyHunters currently holds no such sanctions from the U.S. government or international authorities.
Nevertheless, experts note that corporate victims are frequently guided by cyber insurance providers toward specific incident response firms. Because not all forensics companies are willing to facilitate ransom payments, clients often switch providers when they decide to pay, gravitating toward firms unbothered by ethical or legal qualms regarding extortion payoffs.
This ecosystem has fostered severe conflicts of interest. When ShinyHunters extorted education technology giant PowerSchool—stealing private data belonging to 62 million students and 9.5 million teachers across the U.S. and Canada—the company ultimately paid a $2.85 million ransom. Documentation indicates PowerSchool was assisted in this endeavor by CyberSteward. Although a ShinyHunters affiliate was subsequently sentenced to prison for his role in the hack, the payment failed to stop subsequent extortion waves targeting individual school districts using the exact same stolen records.
Leading cyber incident response firms, including Coveware and Unit 221B, have consistently warned victims against paying ShinyHunters, pointing out that extorted data is frequently retained, resold, or weaponized to target clients directly. The FBI issued similar guidance in a May public service announcement.
Internal communications recovered by investigators reveal the profound frustration these warnings caused the leadership of ShinyHunters. In private Telegram chats from April and May 2026, the primary ShinyHunters account complained bitterly to co-conspirators that Coveware was actively ruining their payment success rates by advising victims against capitulating to demands. In one exchange, the operator lamented that the group was struggling to secure payments because Coveware was repeatedly getting involved, explicitly noting an intent to "eliminate the problem." Coveware declined to comment on the threats.
Industry leaders argue that the compensation models utilized by some negotiation firms exacerbate these conflicts. Mark Camillo, chief executive of CyberAcuView, an industry group established by major cyber insurers, pointed out that while some firms charge flat retainers, others charge a percentage of the final ransom payout. This fee structure creates an inherent conflict of interest, incentivizing negotiators to facilitate payouts and avoid aggressive reductions in ransom amounts.
"It has come to the industry’s attention that many of the ransomware payers charge a percentage of the final payment which may or may not be disclosed," Camillo observed. "This makes no sense if they are also the negotiator. There needs to be more transparency in the process as no one in the ecosystem should be profiting purely on the size of the ransomware transaction or payment itself."
Recent federal prosecutions underscore these systemic vulnerabilities. The U.S. Department of Justice has increasingly targeted negotiators accused of defrauding their own clients. In October, the DOJ charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy for allegedly charging customers millions for remediation while secretly paying hackers behind their clients’ backs. Similarly, in July, a Florida-based ransomware negotiator was sentenced to over five years in prison for conspiring with the BlackCat ransomware syndicate to leak confidential client negotiating strategies to maximize payouts.
Comments (0)