U.S. federal investigators probing the prolific ShinyHunters cybercrime syndicate—which recently breached and leaked sensitive data from the FBI—have identified senior executives at two separate ransomware negotiation firms who allegedly maintained unusually close and illicit relationships with the extortion group. According to sources close to the unfolding federal probe, one of these U.S.-based executives even went so far as to assist ShinyHunters in operating a dedicated website designed to pressure breached organizations into paying exorbitant ransoms.

Hackers aligned with the ShinyHunters banner have claimed responsibility for dozens of high-profile data breaches dating back to 2019. In its early days, the group was primarily operated by cybercriminals residing in France. However, as those foundational members were systematically arrested, indicted, and jailed by international law enforcement, operational control over the ShinyHunters brand eventually shifted to a teenage hacker from Amman, Jordan, known online as “Rey,” who was publicly identified last year. According to assessments shared by the FBI, the syndicate has successfully extorted more than $70 million from corporate and government victims over the course of the year.

The group’s brazen activities escalated dramatically in late September, when hackers tied to ShinyHunters successfully breached the FBI recruitment portal, fbijobs.gov. To compound the embarrassment, the threat actors taunted federal authorities by threatening to publish a cache of stolen personnel files. Reports indicate the compromised data included sensitive medical and psychological records, Social Security numbers, home addresses, and detailed information regarding individual employee specializations and organizational units.

This direct assault on a federal law enforcement portal prompted the bureau to move with extraordinary speed, arresting, detaining, and questioning individuals suspected of maintaining communications with Rey or other key suspects. On October 3, Reuters reported that Rey had been detained by authorities in Jordan and was actively cooperating with the FBI.

Rey’s elevation to a leadership role within the syndicate was made possible, investigators believe, by the sudden neutralization of a senior European member just weeks prior. On the evening of September 15, law enforcement officers in the Netherlands executed a dramatic raid, arresting convicted hacker and primary ShinyHunters suspect Pepijn van der Stap. Dutch police reportedly deployed flash-bang grenades to disorient Van der Stap as he sat actively logged into multiple online accounts.

According to sources close to the investigation, the timing of the raid allowed authorities to seize control of Van der Stap’s active Signal instant messaging application session. This immediate access exposed a treasure trove of recent communications with frequent contacts, including professional ransomware negotiators operating out of Canada and the United States.

Multiple sources with direct knowledge of the investigation revealed that Van der Stap’s recovered Signal messages proved vital not only to uncovering financial collusion, but also to unraveling a chilling murder-for-hire plot that surfaced immediately following his arrest. Dutch news outlet RTL reported last month that two contract killings were allegedly planned to be carried out abroad, with investigative indications pointing to Van der Stap as the individual who issued the orders, though law enforcement emphasized there is no indication those violent plots were ever executed.

The digital paper trail soon led directly to formal criminal charges. On October 9, KrebsOnSecurity broke the news that the FBI had arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the escalating ShinyHunters investigation. Dubrovsky, who recently authored a published book on managing cyber extortion that explicitly recommended companies always engage with hackers, was charged in U.S. federal court with threatening to disclose hacked data and interfering with interstate commerce through extortion, according to public court records. Politico reported that federal prosecutors subsequently requested Dubrovsky be held in custody pending trial, with related court documents placed under strict legal seal.

Sources close to the ongoing investigation stated that Van der Stap’s decrypted Signal chats documented frequent, substantive conversations between the Dutch hacker, Dubrovsky, and at least one executive at a prominent U.S.-based consulting firm. Troublingly, these conversations revealed that the executives frequently possessed detailed knowledge of newly breached ShinyHunters victims even before the victim organizations themselves had discovered or confirmed the security intrusions.

Perhaps most explosively, federal investigators discovered through Van der Stap’s messaging history that Dubrovsky was fully aware that ShinyHunters had successfully exfiltrated highly sensitive data from FBI servers. Despite this knowledge, Dubrovsky never alerted the bureau to the security breach prior to the public announcement and extortion threats made by ShinyHunters on social media platform X.

SHINYWIRE

As the scope of the federal inquiry widened, investigators uncovered deeper corporate entanglement in the cybercrime ecosystem. Sources close to the probe revealed that the FBI believes at least one executive at a major U.S.-based consulting firm played an active, operational role in managing the now-defunct ShinyHunters victim extortion portal, known as shinywire[.]com. Because formal criminal charges have not yet been filed against the specific individuals, KrebsOnSecurity withheld the name of the prestigious U.S. firm, which employs more than 1,000 associates.

The Shinywire website remained active from approximately May 3 until October 16, cataloging nearly 100 organizations that had fallen victim to ShinyHunters breaches. Each listing functioned as a pressure point, urging corporate victims to quickly open dialogue with the cybercrime syndicate to negotiate payment terms. To substantiate their threats, the pages featured authentic samples of stolen files, accompanied by the explicit warning that the complete data sets would be published online if ransom demands were ignored.

Cached internet records captured by scanning services highlighted listings such as the extortion demand directed at Intuitive Surgical, a prominent American medical technology corporation that suffered a security breach in March after an employee fell victim to a targeted phishing campaign. Under the extortion scheme, victim organizations that failed to engage or reach a financial settlement within a strict seven-day window found their stolen data publicly broadcast on the primary ShinyHunters shaming blog, which was hosted exclusively on the Tor anonymity network.

The fallout from the investigation has also triggered intense legal battles in the corporate sphere. In mid-October, The Globe and Mail reported that months prior to his arrest, Edward Dubrovsky had filed a civil lawsuit in Ontario alleging he had become collateral damage in an aggressive campaign by a former business partner seeking to destroy rival industry figures.

Dubrovsky’s legal filings targeted Daniel Tobok, the former chief executive of Cypfer, a Toronto-founded cybersecurity firm with international offices spanning the United States, Britain, the Netherlands, the United Arab Emirates, and Mexico. The two men initially partnered in 2017 to build Cypfer, where Dubrovsky served as managing partner and chief operating officer. However, by 2024, their relationship deteriorated significantly, with Dubrovsky alleging that Tobok gradually pushed him out of key business decisions and implemented increasingly erratic management strategies. Tobok denied the allegations, filing a counter-claim accusing Dubrovsky of misappropriating confidential information and engaging in unfair competition through a separate entity known as CyberSteward Inc.

GHOSTBYTE

The scrutiny surrounding leadership figures in the incident response sector deepened as historical digital footprints emerged. Interviews with several former colleagues of Daniel Tobok revealed that as far back as eight years ago, he was allegedly known among ransomware affiliates by a distinct online handle: Ghostbyte.

In 2018, a Canadian enterprise fell victim to an intrusion orchestrated by Dharma, a prolific, Russian-language ransomware affiliate program active since 2016. When the victim company expressed willingness to pay to recover locked files that could not otherwise be restored, they requested assurances that the cybercriminals would honor their word. In a redacted email response obtained by researchers, the Dharma representative directed the victim to seek guarantees by contacting an IT professional in Canada, explicitly recommending the email address [email protected].

While it remains unclear whether Tobok personally utilized the Ghostbyte address provided by the Dharma affiliate, public records searches conducted by breach tracking firm Constella Intelligence established a direct link between an email address frequently used by Tobok—[email protected]—and online user accounts registered under the username "ghostbyte," including a Snapchat profile. Furthermore, Constella analysis connected the Dharma representative’s email address to a cryptocurrency wallet that processed 38 transactions totaling 43 Bitcoin, valued at approximately $3.5 million.

In an official statement released in mid-October, Cypfer distanced itself from the unfolding criminal proceedings, asserting that the company’s core business model does not involve making or facilitating ransomware payments. A corporate spokesperson stated that the firm had no prior knowledge of Dubrovsky’s arrest and had received no outreach or investigative inquiries from law enforcement.

The statement further clarified that Cypfer and CyberSteward operate as entirely distinct entities with no overlapping officers, directors, or employees. Cypfer noted that it was recently acquired by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. Aon previously acquired Cytelligence, a security consulting firm where Tobok served as founder and CEO and Dubrovsky served as managing partner.

CONFLICTING INTERESTS

The broader investigation has reignited intense debate regarding the legal and ethical complexities of the multi-million-dollar ransomware negotiation industry. Under U.S. law, paying a ransom to obtain an encryption key or secure a promise to delete stolen data is not inherently illegal, provided the recipient group is not designated as a sanctioned entity by the U.S. Treasury Department. Because ShinyHunters has not been placed on formal sanctions lists, victim companies face no direct statutory prohibition against paying them, though the practice remains deeply controversial.

In many corporate intrusions, cyber insurance carriers direct victim organizations to specialized incident response firms to handle extortion negotiations. However, because not all forensic firms are willing to facilitate ransom payouts, clients frequently transition away from non-negotiating security providers toward firms that specialize in securing settlements.

This dynamic creates significant structural friction within the market. According to Mark Camillo, chief executive of CyberAcuView—an industry consortium established by major cyber insurers in 2021—ransomware negotiation firms often charge a contingency fee calculated as a percentage of the total ransom paid. Camillo argued that this compensation model introduces an inherent and dangerous conflict of interest. Negotiators paid on a percentage basis maintain a financial incentive to encourage payouts and refrain from aggressively driving down ransom demands, as a larger settlement directly increases their own remuneration.

Federal prosecutors have increasingly targeted abusive practices within the remediation sector. On October 7, the Department of Justice charged Zohar Pinhasi, the 50-year-old CEO of Florida-based MonsterCloud, with wire fraud and conspiracy. Prosecutors alleged that Pinhasi secretly went behind his clients’ backs to pay ransomware groups $8 million while billing customers $19 million under the guise of technical remediation. Similarly, in July, Florida-based ransomware negotiator Angelo Martino was sentenced to 70 months in prison for conspiring with the BlackCat/ALPHV ransomware group to compromise client confidentiality and maximize extortion payouts.

Meanwhile, prominent incident response firms such as Coveware and Unit 221B have consistently warned corporate victims against paying ShinyHunters, pointing out that stolen data is frequently retained, resold, or used to directly extort downstream clients regardless of payment. The FBI issued a parallel advisory echoing these warnings, cautioning that extortionists rarely honor promises to purge stolen records.

Internal communications recovered by investigators revealed that this firm stance against paying had severely frustrated ShinyHunters leadership. In private Telegram chats from April and May reviewed by law enforcement, syndicate leaders complained bitterly that Coveware’s public advice was actively eroding their payment success rates and causing them to lose lucrative negotiations, prompting frustration within the criminal network as federal pressure closed in from all sides.