U.S. federal investigators pursuing the notorious ShinyHunters hacking group—which recently compromised sensitive data belonging to the Federal Bureau of Investigation—have identified executives at two separate ransomware negotiation firms who maintained unusually close and illicit relationships with the cyberextortion syndicate. Sources close to the investigation indicate that one of these U.S.-based executives even actively assisted ShinyHunters in operating a public website designed to pressure victims into coughing up ransom payments.
The ShinyHunters organization has claimed responsibility for dozens of high-profile data breaches since emerging in 2019, when the collective was primarily operated by cybercriminals based in France. As those founding members were progressively identified, arrested, and jailed, control over the ShinyHunters brand eventually shifted to an administrator known as "Rey." This key figure was identified last year as a teenage hacker residing in Amman, Jordan. According to official FBI estimates, ShinyHunters has successfully extorted more than $70 million from victims globally this year alone.
The group’s brazen activities escalated dramatically in late September, when hackers aligned with ShinyHunters breached the FBI recruitment portal, fbijobs.gov. The attackers taunted federal law enforcement by threatening to publish a cache of stolen internal files. Reports indicate the compromised data included sensitive medical and psychological records, Social Security numbers, home addresses, and detailed information regarding the individual specializations and units of bureau personnel.
This high-profile breach of an internal federal recruitment site prompted the FBI to move with exceptional speed to arrest, detain, and interrogate individuals suspected of communicating with Rey or other key members of the ShinyHunters network. On October 3, Reuters reported that Rey had been detained by authorities in Jordan and was actively cooperating with federal investigators.
Rey’s rise to power within the group was facilitated by the abrupt neutralization of one of the collective’s alleged senior members. On the evening of September 15, law enforcement officers in the Netherlands executed a high-stakes arrest of convicted hacker and ShinyHunters suspect Pepijn van der Stap. Dutch police reportedly deployed flash-bang grenades to stun and apprehend Van der Stap while he was actively logged into various online accounts.
According to sources close to the investigation, authorities apprehended Van der Stap while he was using his Signal instant messaging application. This tactical advantage allowed investigators to immediately review recent communications with frequent contacts, including specialized ransomware negotiators operating out of Canada and the United States.
Multiple sources with direct knowledge of the matter revealed that Van der Stap’s decrypted Signal messages proved critical in unraveling a chilling murder-for-hire plot that surfaced immediately after his arrest. Dutch news outlet RTL reported last month that two contract killings were allegedly planned to be carried out abroad, with investigators finding strong indications that Van der Stap had issued the orders for the attacks, though there is no evidence to suggest those plots were ever executed.
The fallout from the Dutch police raid continued on October 9, when the FBI arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the broadening ShinyHunters investigation. Dubrovsky, who recently published a book on handling cyber extortion that advised victims to always engage with hackers, was formally charged with threatening to disclose stolen data and interfering with interstate commerce through extortion, according to federal court records. Politico reported that prosecutors requested Dubrovsky be held in custody pending trial and that case records remain under court seal.
A source close to the investigation shared that Van der Stap’s Signal archive demonstrated frequent, direct conversations between the Dutch hacker, Dubrovsky, and at least one executive at a prominent U.S.-based consulting firm. Disturbingly, these executives often possessed inside details regarding new ShinyHunters data breaches before the victimized organizations themselves had even discovered they were compromised.
Furthermore, investigators uncovered a potentially explosive detail: the Dutch hacker’s chats showed that Dubrovsky was fully aware ShinyHunters had exfiltrated highly sensitive personnel files from federal servers. Despite this knowledge, Dubrovsky never alerted the bureau prior to the hackers publicly threatening on social media to expose the deeply personal internal files.
SHINYWIRE
Investigators probing the ShinyHunters network have uncovered that at least one executive at a U.S.-based consulting firm played an active role in operating "shinywire[.]com," a now-defunct extortion portal utilized by the hackers. KrebsOnSecurity has chosen to withhold the names of the U.S. company and the suspected executives pending formal criminal charges, though the entity is recognized as a prestigious firm employing more than 1,000 associates.
The Shinywire website operated from approximately May 3 until October 16, featuring listings for nearly 100 organizations compromised by ShinyHunters. Each entry aggressively urged victim companies to initiate contact with the cybercrime syndicate to negotiate payment terms. The web pages also displayed samples of stolen corporate data, accompanied by explicit warnings that the full files would be leaked online if extortion demands were ignored.
Cached internet records highlight how the portal targeted organizations such as Intuitive Surgical, an American medical technology firm breached in March after an employee fell victim to a targeted phishing email campaign. Victim organizations that refused to engage in negotiations within a strict seven-day window routinely found their stolen proprietary information published on the official ShinyHunters shaming blog, which is accessible exclusively via the Tor anonymity network.
Legal and industry pressures have further complicated the landscape. In mid-October, The Globe and Mail reported that months prior to his federal arrest, Dubrovsky had filed a civil lawsuit in Ontario alleging he had become collateral damage in a bitter campaign by a former business partner seeking to ruin another industry leader.
The lawsuit targeted Daniel Tobok, the former chief executive of Cypfer, a prominent cybersecurity firm founded in Toronto with international offices spanning the United States, Britain, the Netherlands, the United Arab Emirates, and Mexico. Dubrovsky and Tobok initially partnered in 2017 to build Cypfer, where Dubrovsky served as managing partner and chief operating officer. However, by 2024, the business partnership had fractured. Dubrovsky accused Tobok of gradually freezing him out of core business decisions and exhibiting increasingly erratic management behavior. Tobok denied the allegations and filed a counterclaim accusing Dubrovsky of misappropriating confidential information and competing unfairly through a separate entity named CyberSteward Inc.
GHOSTBYTE
Interviews with former colleagues of Daniel Tobok indicate that as far back as eight years ago, the executive was known within certain ransomware circles by the alias "Ghostbyte." In 2018, a Canadian company fell victim to Dharma, a prolific Russian-language ransomware affiliate program that emerged in 2016. When the victim expressed concern about whether the cybercriminals would honor an agreement to decrypt locked files after payment, the Dharma representative explicitly directed them toward a Canadian IT professional for assurances.
A redacted copy of the correspondence shows the ransomware operator instructing the victim to contact an individual via the email address [email protected]. The representative advised that the designated IT company frequently resolved such challenges in Canada, assuring the victim that they could sign a service contract to secure guarantees.
While it remains unverified whether Tobok actively utilized the Ghostbyte email address, breach intelligence service Constella Intelligence discovered that an email address frequently used by Tobok—[email protected]—was linked to online accounts registered under the username "ghostbyte," including a Snapchat profile. Additionally, Constella tied the Dharma representative’s fallback email address to a cryptocurrency wallet that processed dozens of transactions worth millions of dollars.
In a public statement issued in mid-October, Cypfer maintained that its official business model does not involve facilitating or making ransomware payments. The company stated that it learned of Dubrovsky’s arrest through media reports and had no prior knowledge of the federal action. Furthermore, Cypfer emphasized that it has received no outreach from law enforcement and is not the subject of any active investigation.
The statement noted that CyberSteward and Cypfer operate as entirely separate entities with no shared officers, directors, or employees. Cypfer was recently acquired by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. Aon previously acquired Cytelligence in 2020, a security consulting firm where Tobok served as founder and CEO and Dubrovsky operated as managing partner.
CONFLICTING INTERESTS
Under U.S. law, paying a ransom to obtain an encryption key or secure a promise to delete stolen data is not explicitly illegal, provided the hacker collective is not designated as a sanctioned terrorist or criminal organization by the U.S. Department of Treasury. Because ShinyHunters is not currently subject to government sanctions, victims technically retain the legal latitude to negotiate.
Organizations facing debilitating cyberattacks are typically directed by their cyber insurance providers to collaborate with specialized incident response firms. However, industry practices vary widely; while some forensic companies refuse to facilitate extortion payments on principle, others willingly step in when clients decide to pay.
A prime example occurred in December 2024, when ShinyHunters targeted educational technology giant PowerSchool, compromising private records belonging to millions of students and teachers across the United States and Canada. PowerSchool reportedly paid a $2.85 million ransom with the assistance of CyberSteward. Despite the payment, subsequent extortion waves targeting individual school districts emerged months later using samples of the exact same stolen data. This underscored a fundamental reality of cyber extortion: there is no technical guarantee that threat actors have permanently deleted stolen files or that other bad actors will not exploit the same leaked records.
Leading incident response firms, including Coveware and Unit 221B, have consistently warned victims against paying ShinyHunters, pointing out that exfiltrated data is frequently retained, resold, or weaponized to target clients directly at a later date. These warnings have drawn the ire of ShinyHunters leadership. Private messaging logs obtained by investigators reveal the cybercriminals complaining that Coveware’s public guidance was severely undercutting their success rate and actively preventing victims from paying ransoms.
Industry experts have long pointed out inherent conflicts of interest within the negotiation ecosystem. Mark Camillo, chief executive of CyberAcuView, noted that while some firms operate on flat retainer fees, others charge a percentage of the total ransom amount negotiated. This financial structure creates a perverse incentive for negotiators to favor the attackers by securing higher payouts rather than driving down costs.
Recent federal prosecutions underscore these systemic vulnerabilities. The U.S. Department of Justice has increasingly targeted intermediaries accused of defrauding clients. In October, federal prosecutors charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy after he allegedly charged clients millions for remediation while secretly paying out lesser amounts to hackers. Similarly, a Florida-based ransomware negotiator was sentenced to prison earlier this year for conspiring with the Blackcat/ALPHV ransomware group to leak confidential client negotiation strategies and maximize ransom extraction.
