U.S. federal investigators pursuing the notorious ShinyHunters hacking group—which recently executed a high-profile cyberattack to steal sensitive data from the Federal Bureau of Investigation (FBI)—have uncovered deep and illicit ties within the cybersecurity industry. Authorities have identified senior executives at two separate ransomware negotiation firms who allegedly maintained unusually close relationships with the extortion syndicate. Sources close to the ongoing federal investigation revealed that one of these U.S.-based executives even went so far as to actively assist ShinyHunters in operating a public pressure website designed to coerce victims into paying extortion demands.
The ShinyHunters collective has claimed responsibility for dozens of major corporate and institutional data breaches since 2019. Originally operated primarily by cybercriminals based in France, the group’s leadership structure shifted as law enforcement systematically arrested or jailed its founding members. Control of the ShinyHunters brand eventually transitioned to an administrator known as “Rey,” who was identified last year as a teenage hacker residing in Amman, Jordan. According to estimates provided by the FBI, ShinyHunters has successfully extorted more than $70 million from victims globally over the course of the year.
The group’s brazen operations reached a critical inflection point in late September, when hackers aligned with ShinyHunters breached the FBI recruitment website, fbijobs.gov. The attackers taunted federal law enforcement by threatening to publish a cache of stolen internal files. According to reports, the compromised data included sensitive medical and psychological records, Social Security numbers, home addresses, and detailed information regarding the specific units and specializations of FBI employees.
The compromise of the bureau’s jobs portal prompted federal authorities to act with exceptional speed, moving to detain and interrogate individuals who had maintained communications with Rey or other key suspects. Reuters reported on October 3 that Rey had been detained by Jordanian authorities and was actively cooperating with the FBI.
Rey’s elevation to the head of the hacking group followed the sudden incapacitation of a senior confederate. On the evening of September 15, law enforcement officers in the Netherlands executed a tactical arrest of convicted hacker and ShinyHunters suspect Pepijn van der Stap, deploying flash-bang grenades to stun him while he remained logged into various active online accounts.
According to sources close to the inquiry, Dutch police apprehended Van der Stap while he was actively using his Signal instant messaging application. This tactical timing provided investigators with immediate access to his recent communications, laying bare a network of frequent contacts that included ransomware negotiators stationed in both Canada and the United States.
Multiple sources with direct knowledge of the matter indicated that Van der Stap’s decrypted Signal messages proved critical in unraveling an emerging murder-for-hire plot that surfaced in the immediate wake of his arrest. Dutch news outlet RTL reported that the alleged murder plot targeted individuals abroad, with investigators finding indications that Van der Stap had issued the orders for the attacks, though there is no evidence that those directives were ever executed.
The digital footprint recovered from Van der Stap’s devices soon expanded the scope of the federal crackdown. On October 9, KrebsOnSecurity broke the news that the FBI had arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the sprawling ShinyHunters investigation. Dubrovsky, who recently authored a book on handling cyber extortion that advised victims to maintain a dialogue with hackers, was formally charged in U.S. federal court with threatening to disclose hacked data and interfering with interstate commerce through extortion. Court records indicate that federal prosecutors have requested Dubrovsky remain in custody pending trial, and case-related records have been placed under seal.
Investigators analyzing Van der Stap’s messaging history discovered that the Dutch hacker engaged in frequent conversations with Dubrovsky and at least one executive at a major U.S.-based consulting firm. According to a source familiar with the investigation, these executives routinely possessed detailed information regarding newly compromised ShinyHunters victims even before the targeted organizations themselves were aware of the security breaches.
Perhaps most explosive among the federal findings is evidence showing that Dubrovsky was fully aware that ShinyHunters had exfiltrated highly sensitive data from FBI servers. Investigators noted that Dubrovsky never informed the bureau of the breach prior to the extortion group publicly threatening on Twitter/X to release the agency’s deeply personal personnel files.
SHINYWIRE
As the investigation widened, federal authorities uncovered further operational integration between cybercriminals and corporate insiders. Sources close to the probe revealed that investigators believe at least one executive at a prominent U.S. consulting firm played an active role in operating shinywire.com, a now-defunct extortion portal utilized by ShinyHunters. Because formal criminal charges have not yet been filed against the individual, media outlets are withholding the names of the U.S. company and the suspected executive, though the firm is known to be a prestigious organization employing more than 1,000 associates.
The Shinywire platform operated from approximately May 3 until October 16, cataloging nearly 100 corporate and institutional entities compromised by ShinyHunters. Each listing on the site pressured victims to open communications with the cybercrime syndicate to negotiate payment terms. To substantiate their threats, the operators published samples of stolen files, warning that complete data repositories would be publicly released if victims ignored the demands.
Cached records from indexing services like urlscan.io highlighted extortion demands targeting high-profile entities, such as Intuitive Surgical, an American medical technology firm breached in March after an employee fell victim to a targeted phishing email that compromised corporate credentials. Under the mechanics of the scheme, victim organizations that refused to engage or negotiate within a seven-day window found their stolen data published on the group’s primary shaming blog, which was accessible exclusively via the Tor anonymity network.
The fallout from the investigation has also spilled into civil litigation. In mid-October, The Globe and Mail reported that Edward Dubrovsky had filed a lawsuit in Ontario earlier in the year against Daniel Tobok, the former chief executive of Cypfer, a prominent cybersecurity firm with global offices. Dubrovsky and Tobok initially became business partners in 2017, eventually building Cypfer together where Dubrovsky served as a managing partner and chief operating officer. However, by 2024, the partnership fractured amid allegations that Tobok was progressively sidelining Dubrovsky and making erratic management decisions. Tobok denied the claims and filed a counterclaim accusing Dubrovsky of accessing confidential information and competing unfairly through a separate venture called CyberSteward Inc., while asserting that Dubrovsky was never a company founder or shareholder.
GHOSTBYTE
Interviews with former colleagues of Daniel Tobok revealed that years prior to these corporate disputes, he was known among ransomware actors by the online moniker "Ghostbyte." In 2018, a Canadian enterprise fell victim to Dharma, a prolific Russian-language ransomware affiliate program active since 2016. When the victim expressed hesitation over paying the ransom due to unrecoverable file corruption, they sought guarantees that the attackers would honor their word.
In a redacted email response reviewed by investigators, the Dharma representative directed the victim to contact an IT professional in Canada who could provide such assurances, pointing them toward the email address [email protected]. The representative advised the victim to establish a formal service contract with the individual, noting that the IT company frequently resolved similar extortion scenarios in Canada.
While it remains unconfirmed whether Tobok actively utilized the Ghostbyte email address, breach-tracking services including Constella Intelligence identified that a primary personal email address frequently used by Tobok—[email protected]—was linked to online accounts utilizing the "ghostbyte" username, including a Snapchat profile. Furthermore, Constella’s analysis tied the Dharma representative’s contact email to a cryptocurrency wallet that processed dozens of Bitcoin transactions valued at millions of dollars.
In an official statement, Cypfer maintained that its core business operations do not involve facilitating or making ransomware payments, and stated that corporate leadership learned of Dubrovsky’s arrest through media reports. The company emphasized that it had received no outreach from law enforcement and was not the target of any ongoing investigation. Cypfer noted that it operates entirely independently from CyberSteward, sharing no officers, directors, or employees, and highlighted its recent acquisition by the Apros Group, a holding company led by former FBI special agent Jason Hogg.
CONFLICTING INTERESTS
The broader landscape of cyber extortion reveals complex financial incentives and deep industry divisions regarding ransom payments. While paying a ransom is not inherently illegal in the United States unless directed at groups sanctioned by the U.S. Treasury Department—a designation ShinyHunters has not received—it remains a subject of intense debate among security professionals.
Victim organizations are frequently directed by cyber insurance providers to engage specialized incident response firms. However, not all forensic companies agree to facilitate payments on behalf of clients. When strict remediation firms refuse to negotiate with extortionists, clients often transition to firms willing to execute payouts.
This dynamic came to the forefront during the late 2024 extortion campaign against educational technology provider PowerSchool, which saw private data concerning millions of students and teachers compromised. Though PowerSchool reportedly paid a multi-million-dollar ransom assisted by CyberSteward, subsequent extortion attempts targeted individual school districts using identical stolen records. Leading incident response firms, including Coveware and Unit 221B, have consistently warned against paying ShinyHunters, pointing out that threat actors frequently retain copies of stolen data for resale or secondary extortion.
Internal communications reviewed by federal investigators demonstrated the friction caused by firms advising against payment. Telegram chats recovered from ShinyHunters operators in early 2026 revealed deep frustration directed at Coveware, with the group complaining that the firm’s anti-payment advisories were undercutting their ransom collection rates and openly discussing efforts to neutralize the impediment.
Industry executives have also criticized compensation structures within the negotiation ecosystem. Mark Camillo, chief executive of CyberAcuView, noted that while some incident response providers charge flat retainers, others take a percentage of the final ransom payout. Camillo argued that this percentage-based model introduces an inherent conflict of interest, creating a financial incentive for negotiators to maximize payouts rather than reduce them.
Federal authorities have increasingly targeted fraudulent practices among ransomware facilitators. In October, the Department of Justice charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy, alleging that he secretly paid ransomware actors millions behind his clients’ backs while billing them vastly inflated remediation fees. Similarly, in July, Florida-based ransomware negotiator Angelo Martino was sentenced to prison for conspiring with the Blackcat/ALPHV syndicate to exploit confidential client negotiation strategies and maximize extortion amounts.
