U.S. federal investigators pursuing the prolific ShinyHunters hacking group—which recently compromised sensitive data from the FBI—have identified executives at two distinct ransomware negotiation firms who maintained unusually close and illicit relationships with the extortion syndicate. Sources close to the ongoing investigation indicate that one of these executives, based in the United States, actively assisted ShinyHunters in operating a pressurized extortion website designed to coerce victims into paying ransoms.

Hackers aligned with the ShinyHunters brand have claimed responsibility for dozens of high-profile data breaches since 2019, when the collective was primarily operated by cybercriminals residing in France. As those original members were progressively apprehended and jailed by law enforcement, control over the ShinyHunters umbrella eventually shifted to a teenage hacker from Amman, Jordan, known online as “Rey,” who was identified by researchers last year. According to estimates from the FBI, ShinyHunters has successfully extorted more than $70 million from victims over the course of the year.

The group drew unprecedented scrutiny in late September when they successfully breached the FBI recruitment portal, fbijobs.gov. The hackers taunted federal law enforcement by threatening to publish a cache of stolen internal files, which reportedly included sensitive medical and psychological records, Social Security numbers, home addresses, and detailed information regarding employee specializations and organizational units.

This brazen attack on a federal law enforcement portal prompted the FBI to act with exceptional speed, detaining and questioning individuals who had maintained communications with Rey or other suspects linked to the collective. Reuters reported that Rey was detained by Jordanian authorities in early October and has since been cooperating with federal investigators.

Rey’s rise to control over the hacking group followed the sudden arrest of a key senior member. On the evening of September 15, law enforcement officers in the Netherlands executed a high-impact operation in which they used flash-bang grenades to stun and apprehend convicted hacker and ShinyHunters suspect Pepijn van der Stap while he was actively logged into several online accounts.

According to sources close to the investigation, Dutch authorities managed to arrest Van der Stap while he was using his Signal instant messaging account. This tactical advantage granted investigators real-time access to his recent communications with frequent contacts, including ransomware negotiators located in Canada and the United States.

Multiple sources with direct knowledge of the matter revealed that Van der Stap’s decrypted Signal messages became the critical breakthrough needed to unravel a disturbing murder-for-hire plot that surfaced immediately following his arrest. The Dutch news outlet RTL reported that two murders were allegedly planned to be carried out abroad, with indications pointing to Van der Stap as the individual who issued the orders, though authorities have found no evidence that the plots were ever executed.

The digital footprint led directly to further arrests. On October 9, federal authorities arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the sprawling ShinyHunters investigation. Dubrovsky, who had recently published a book on managing cyber extortion that advocated for open engagement with hackers, was formally charged in court records with threatening to disclose hacked data and interfering with interstate commerce through extortion. Prosecutors subsequently requested that Dubrovsky remain in custody pending trial, with case records placed under seal.

Investigative sources noted that Van der Stap’s Signal logs showed frequent, detailed conversations between the Dutch hacker, Dubrovsky, and an executive at a prominent U.S.-based consulting firm. These communications revealed that the negotiators often possessed inside knowledge regarding new ShinyHunters victims before the target organizations themselves had even discovered the breaches. Furthermore, investigators uncovered that Dubrovsky was aware that ShinyHunters had compromised deeply sensitive data on FBI servers but failed to notify the bureau before the cybercriminals publicly threatened to release the personnel files on social media.

SHINYWIRE

As the probe expanded, investigators uncovered deeper corporate entanglement with the hacking syndicate. Sources close to the ShinyHunters investigation revealed that federal authorities believe at least one executive at a U.S.-based consulting firm played an active role in operating the now-defunct victim extortion website known as shinywire[.]com. While law enforcement has not yet filed criminal charges against the specific executive or the firm—a prestigious organization with more than 1,000 associates—authorities have withheld their identities pending further developments.

The Shinywire platform remained active from early May until mid-October, featuring entries for nearly 100 organizations that had fallen victim to ShinyHunters. Each listing functioned as a pressure point, urging corporate victims to negotiate payment terms while displaying samples of stolen files and warning that the data would be permanently leaked if demands were ignored.

Cached internet records documented extortion listings targeting major enterprises, such as Intuitive Surgical, an American medical technology firm compromised earlier in the year after an employee fell victim to a targeted credential-harvesting phishing campaign. Organizations that refused to negotiate within a strict seven-day window found their proprietary data published on the primary ShinyHunters shaming blog, which is accessible exclusively via the Tor anonymity network.

The fallout from the investigation has also triggered corporate infighting and legal battles. Media reports revealed that months prior to his arrest, Dubrovsky had filed a lawsuit in Ontario against Daniel Tobok, the former chief executive of Cypfer, a prominent cybersecurity firm with global offices. The two men had originally partnered to build Cypfer, where Dubrovsky served as chief operating officer, before a bitter falling out in 2024 amid accusations of marginalization and erratic decision-making. Tobok denied the allegations and filed a counterclaim accusing Dubrovsky of misappropriating confidential information and competing unfairly through another entity named CyberSteward Inc.

GHOSTBYTE

The web of associations extended further into the historical roots of the ransomware ecosystem. Interviews with former colleagues of Tobok indicated that as far back as eight years ago, he was known among certain ransomware purveyors by the alias "Ghostbyte." In 2018, a Canadian company targeted by the Dharma ransomware affiliate program sought guarantees that their encrypted files could be unlocked and that the extortionists would honor their word. In email communications reviewed by investigators, a Dharma representative advised the victim to contact an IT professional using the email address [email protected], stating that the designated individual frequently resolved similar extortion disputes in Canada.

While it remains unconfirmed whether Tobok actively used the Ghostbyte email address, breach intelligence data from Constella Intelligence indicated that a personal email address frequently used by Tobok was linked to multiple online accounts bearing the username "ghostbyte," including a Snapchat profile. Furthermore, blockchain analysis connected the Dharma representative’s fallback email address to a cryptocurrency wallet that had processed substantial Bitcoin transactions worth millions of dollars.

Representatives for Cypfer issued a statement clarifying that the firm does not facilitate ransomware payments and maintained no prior knowledge of Dubrovsky’s arrest. The company emphasized that it was not the target of any law enforcement investigation and operates independently from CyberSteward, having recently been acquired by the Apros Group, a holding company led by former FBI special agent Jason Hogg.

CONFLICTING INTERESTS

The ongoing federal crackdown highlights deep structural conflicts within the commercial cyber defense and incident response market. While paying a ransom to recover encrypted data is not inherently illegal in the United States unless the recipient is explicitly designated on a sanctions list—a status ShinyHunters has not officially attained—the involvement of intermediaries has increasingly drawn prosecutorial scrutiny.

Industry experts note that ransomware victims are frequently steered by cyber insurers toward specific incident response firms. However, because some forensics providers refuse to facilitate extortion payments, clients often switch to firms willing to handle negotiations. This dynamic creates significant ethical and financial hazards, particularly when negotiators derive their compensation as a percentage of the total ransom paid.

Law enforcement agencies have increasingly targeted negotiators who abuse this position. Federal prosecutors recently charged the CEO of MonsterCloud with wire fraud and conspiracy for allegedly billing clients millions for remediation while secretly paying lower sums to hackers, and previously secured a long prison sentence for a Florida negotiator who colluded with the BlackCat ransomware group to maximize victim payouts.

As federal investigations into ShinyHunters and its associates continue to unfold, authorities are scrutinizing the boundary where professional incident response ends and criminal facilitation begins, seeking to dismantle the networks that allow digital extortionists to monetize stolen data.