U.S. federal investigators pursuing the notorious ShinyHunters hacking group—which recently compromised highly sensitive data belonging to the Federal Bureau of Investigation—have identified executives at two different ransomware negotiation firms who maintained unusually close and illicit relationships with the cyberextortion syndicate. Sources close to the ongoing investigation revealed that one of these executives, based in the United States, even went so far as to help ShinyHunters operate a dedicated web portal designed to pressure corporate victims into coughing up lucrative ransom payments.
Hackers aligned with the ShinyHunters banner have claimed responsibility for dozens of major data breaches since 2019. During its initial years, the collective was primarily operated by cybercriminals residing in France. However, as those foundational members were systematically arrested, prosecuted, and jailed one by one, operational control of the ShinyHunters brand eventually shifted to "Rey," an alias belonging to a teenage hacker based in Amman, Jordan, who was unmasked by researchers late last year. According to estimates from the FBI, the renewed ShinyHunters enterprise has successfully extorted more than $70 million from corporate and institutional victims over the course of the year.
The group crossed a major threshold in late September when they successfully breached the FBI recruitment website, fbijobs.gov. The hackers brazenly taunted federal law enforcement by threatening to publish a cache of stolen files. Reportedly, the compromised data included sensitive medical and psychological records, Social Security numbers, home addresses, and detailed internal information regarding the operational units and specializations of bureau employees.
This high-profile compromise of an internal federal recruitment portal compelled the FBI to move with uncommon swiftness to arrest, detain, and interrogate individuals suspected of maintaining communications with Rey or other key figures within the ShinyHunters network. On October 3, Reuters reported that Rey had been detained by authorities in Jordan and was actively cooperating with the FBI.
Rey’s ascent to administrative control over the hacking collective was made possible because one of the group’s alleged senior members had just been neutralized. On the evening of September 15, law enforcement officers in the Netherlands executed a high-stakes raid, arresting convicted hacker and primary ShinyHunters suspect Pepijn van der Stap. Dutch police reportedly deployed flash-bang grenades in a tactical effort to stun and apprehend Van der Stap while he was actively logged into various online accounts.
According to sources close to the investigation, authorities intercepted Van der Stap while he was utilizing his Signal instant messaging application. This tactical seizure allowed investigators to preserve and review recent communications with frequent contacts, which prominently included ransomware negotiators operating out of Canada and the United States.
Multiple sources with direct knowledge of the matter indicated that Van der Stap’s decrypted Signal messages proved critical in unraveling an alarming murder-for-hire plot that surfaced immediately following his arrest. The Dutch news outlet RTL reported that two planned murders were allegedly scheduled to be carried out abroad, with investigative indications pointing to Van der Stap as the individual who issued the orders, though there is no evidence suggesting those directives were ever executed.
On October 9, the investigation took another dramatic turn when the FBI arrested a 54-year-old Canadian cybersecurity executive named Edward Dubrovsky in connection with the sprawling ShinyHunters probe. Dubrovsky, who had recently authored a book on handling cyber extortion that explicitly advised victims to always engage and negotiate with hackers, was formally charged in U.S. federal court with threatening to disclose stolen data and interfering with interstate commerce through extortion. According to court records, federal prosecutors subsequently requested that Dubrovsky remain in federal custody pending trial, and records associated with his criminal case have been placed under seal.
A source close to the investigation revealed that Van der Stap’s Signal message logs demonstrated frequent, direct conversations between the Dutch hacker, Dubrovsky, and at least one executive at a prominent U.S.-based consulting firm. Troublingly, these executives routinely possessed detailed knowledge regarding newly targeted ShinyHunters victims long before the victim organizations themselves were even aware that their networks had been breached.
Furthermore, federal investigators uncovered what they describe as a potentially explosive detail: the Dutch hacker’s chat logs confirmed that Dubrovsky was fully aware that ShinyHunters had successfully exfiltrated highly sensitive data from FBI servers. Despite this profound security lapse, Dubrovsky never notified the bureau of the data breach before the hackers publicly announced their success and threatened to publish deep personnel files on social media platforms.
SHINYWIRE
As the probe widened, investigators discovered that the conspiracy extended beyond mere intelligence sharing. Two independent sources close to the ShinyHunters inquiry revealed that federal authorities believe at least one executive at a prestigious U.S.-based consulting firm played an active, operational role in managing the now-defunct ShinyHunters victim extortion portal, known as "shinywire[dot]com." Because formal criminal charges have not yet been filed against this specific individual or firm—an organization boasting more than 1,000 associates—news outlets are withholding their identities for the time being.
The Shinywire domain was active from approximately May 3, 2026, until October 16, serving as a clearinghouse that featured entries for nearly 100 corporate and institutional organizations compromised by ShinyHunters. Each entry on the portal was engineered to pressure victim entities into entering negotiations for extortion payouts. The web pages featured distressing samples of stolen files alongside explicit warnings that the full data caches would be disseminated publicly if the victim ignored the ransom demands.
Cached portions of the site indexed by threat intelligence services highlighted attacks such as the one launched against Intuitive Surgical, an American medical technology company that suffered a network breach in March after an employee fell victim to a targeted phishing campaign. Under the extortionists’ operational model, victim organizations that refused to engage or negotiate within a strict seven-day window found all of their stolen proprietary data published indiscriminately on the main ShinyHunters shaming blog, which was hosted exclusively on the Tor anonymity network.
Legal and industry pressures have further complicated the landscape. In mid-October, reports surfaced detailing bitter legal battles within the executive ranks of the cybersecurity industry. A few months prior to his arrest, Edward Dubrovsky had filed a lawsuit in Ontario alleging he had become collateral damage in an aggressive campaign by a former business partner seeking to destroy his career.
Dubrovsky’s legal filings targeted Daniel Tobok, the former chief executive of Cypfer, a prominent cybersecurity firm founded in Toronto with international offices spanning the United States, Britain, the Netherlands, the United Arab Emirates, and Mexico. Having founded Cypfer together as business partners starting in 2017, the two executives experienced a severe falling out by 2024, with Dubrovsky accusing Tobok of gradually freezing him out of core business operations and executing increasingly erratic corporate maneuvers. Tobok countered these claims by filing a lawsuit alleging that Dubrovsky had misappropriated confidential information and engaged in unfair competition through a separate venture known as CyberSteward Inc., while also falsely representing himself as an original founder of Cypfer.
GHOSTBYTE
The tangled histories of key figures in the ransomware negotiation sector extend even further into the past. Interviews with several former colleagues of Daniel Tobok revealed that as far back as eight years ago, he was known within cybercrime circles by a specific moniker: Ghostbyte.
In 2018, a Canadian enterprise fell victim to an intrusion orchestrated by Dharma, a prolific Russian-language ransomware affiliate program active since 2016. When the victim company expressed willingness to pay to recover locked files but demanded assurances that the extortionists would honor their word, the Dharma representative pointed them toward a third party. A redacted copy of the attacker’s email reply advised the victim to contact an IT professional in Canada who specialized in resolving such crises, directing them to the email address [email protected].
While it remains unclear whether Tobok personally utilized the Ghostbyte email address provided by the Dharma affiliate, a search conducted by the breach tracking service Constella Intelligence revealed that an email address frequently used by Tobok—[email protected]—was directly linked to online accounts utilizing the username "ghostbyte," including a Snapchat profile. Furthermore, Constella established that the Dharma representative’s email address was tied to a cryptocurrency wallet that processed dozens of transactions totaling substantial sums of Bitcoin.
In official statements issued following these developments, Cypfer maintained that its core business operations do not involve making or facilitating ransomware payments. Company representatives asserted that they had no prior knowledge of Dubrovsky’s arrest prior to media reports, had received no outreach from law enforcement agencies, and were not the targets of any active federal investigations. Furthermore, Cypfer emphasized that it operates entirely separate from CyberSteward, sharing no common directors, officers, or employees, and noted that Cypfer was recently acquired by the Apros Group, a holding company led by former FBI special agent Jason Hogg.
CONFLICTING INTERESTS
The legal and ethical gray areas surrounding ransomware negotiations have long challenged the cybersecurity ecosystem. Under U.S. law, it is not inherently illegal to pay hackers for an encryption key to restore locked systems or to secure a promise that stolen files will be deleted. However, organizations face severe criminal liability if they knowingly disburse funds to criminal collectives subject to economic sanctions by the U.S. Department of the Treasury, though ShinyHunters has not formally been placed on government sanctions lists.
Industry experts note that corporate victims are frequently guided by cyber insurance providers to engage specialized incident response firms. Yet, a stark philosophical divide persists within the security sector: while some firms refuse to facilitate extortion payments on principle, others eagerly step in when corporate clients decide to pay.
This dynamic was starkly illustrated in the aftermath of ShinyHunters’ December 2024 extortion campaign targeting PowerSchool, an educational technology provider. The cyberattack compromised private data belonging to tens of millions of students and teachers across the United States and Canada. While PowerSchool ultimately paid a multi-million-dollar ransom with the assistance of CyberSteward, the payment failed to prevent subsequent waves of extortion targeting individual school districts using the exact same stolen records.
Leading cyber incident response firms, such as Coveware and Unit 221B, have consistently warned corporate clients against paying ransom demands to ShinyHunters. Investigators point out that cybercriminals have no incentive to securely delete exfiltrated data, frequently retaining, reselling, or weaponizing the information in subsequent attacks. The FBI echoed these warnings in an official public service announcement advising organizations against capitulating to the group’s demands.
Internal communications reviewed by investigators reveal the extent to which Coveware’s staunch anti-payment stance infuriated ShinyHunters leadership. In private Telegram chats intercepted by authorities, the main operator of the ShinyHunters account complained bitterly to co-conspirators that Coveware was actively harming their business model and depressing their successful payment rates by advising victims not to negotiate.
Industry leaders argue that the compensation models utilized by certain ransomware remediation firms create an inherent conflict of interest. Mark Camillo, chief executive of CyberAcuView—an industry organization established by major cyber insurance carriers—noted that firms charging a percentage-based fee on the total ransom amount stand to gain financially from inflated payouts.
"It has come to the industry’s attention that many of the ransomware payers charge a percentage of the final payment which may or may not be disclosed," Camillo stated, emphasizing that negotiators should not hold a financial stake in the sheer volume of a transaction. "There needs to be more transparency in the process as no one in the ecosystem should be profiting purely on the size of resins or transactions."
Federal prosecutors have increasingly targeted these misaligned incentives through criminal indictments. In October, the Department of Justice charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy, alleging that he secretly paid hackers millions behind his clients’ backs while billing victims heavily inflated remediation fees. Similarly, in July, a Florida-based ransomware negotiator was sentenced to prison for conspiring with the BlackCat ransomware syndicate to leak confidential client negotiation strategies, thereby enabling attackers to maximize their extortion payouts.
