U.S. federal authorities pursuing the ShinyHunters hacking group have identified executives at two separate ransomware negotiation firms who maintained unusually close relationships with the extortionists. According to sources close to the investigation, one executive based in the United States allegedly assisted ShinyHunters in operating a website designed to pressure victims into paying ransoms. The probe intensified after ShinyHunters recently stole highly sensitive data from the FBI, prompting swift action to arrest and question individuals with communications links to the group.
ShinyHunters has claimed responsibility for dozens of major data breaches since 2019. Originally operated by cybercriminals in France, control of the brand eventually passed to a teenage hacker from Amman, Jordan, known as "Rey." The FBI reports that ShinyHunters has extorted more than $70 million from victims this year alone. In late September, the group hacked the FBI recruitment website, fbijobs.gov, threatening to publish stolen files containing medical records, Social Security numbers, and employee home addresses. Following the breach, Reuters reported on October 3 that Rey had been detained by Jordanian authorities and was cooperating with the FBI.
The investigation gained significant traction after Dutch authorities arrested convicted hacker Pepijn van der Stap on September 15, 2026. Police used flash-bang grenades to apprehend Van der Stap while he was logged into various online accounts. Authorities seized his Signal instant messaging account, revealing communications with frequent contacts, including ransomware negotiators in Canada and the United States. These messages provided key evidence linking executives to a murder-for-hire plot that allegedly emerged immediately after Van der Stap's arrest, though there is no indication the orders were carried out.
On October 9, the FBI arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive and author of a book on handling cyber extortion. Court records charge Dubrovsky with threatening to disclose stolen data and interfering with interstate commerce through extortion. Sources indicate that Van der Stap's messages showed Dubrovsky frequently conversed with him and at least one executive at a large U.S.-based consulting firm. These executives reportedly knew details about new ShinyHunters victims before the victims themselves were aware of the breaches. Furthermore, investigators found that Dubrovsky knew ShinyHunters had stolen sensitive data from FBI servers but failed to inform the bureau before the group threatened to publish the files on social media.
Federal investigators believe an executive at a prestigious U.S. consulting firm with over 1,000 associates played an active role in operating "shinywire[.]com," a now-defunct extortion website used by ShinyHunters. The site was active from May 3, 2026, until October 16 and featured entries for nearly 100 hacked organizations. Each entry urged victims to negotiate payment terms and included samples of stolen files, promising publication if demands were ignored. Organizations that refused to engage within seven days had their data published on a ShinyHunters shaming blog accessible only via the Tor network.
The investigation also uncovered a complex history involving Daniel Tobok, former CEO of Cypfer, who was known in ransomware circles by the nickname "Ghostbyte." In 2018, a Dharma ransomware representative directed a victim to contact an IT firm at ghostbyte@tutanota.com for guarantees on payment. While it is unclear if Tobok used that specific address, breach tracking service Constella Intelligence found his email associated with online accounts using the username "ghostbyte." Cypfer stated in a release that its business does not include facilitating ransomware payments and claimed no prior knowledge of Dubrovsky's arrest.
The case highlights conflicting interests within the cyber incident response industry. While paying hackers is not illegal in the U.S., experts warn that ShinyHunters often retains stolen data despite promises to delete it. The FBI issued an alert on May 15, 2026, advising victims against paying the group. ShinyHunters members have reportedly harassed employees at firms like Coveware and Unit 221B for advising clients not to pay, with internal chats revealing frustration that these firms were lowering their payment rates.
Industry leaders note that some negotiators charge a percentage of the total ransom, creating an incentive to maximize payouts rather than negotiate them down. The U.S. Department of Justice has recently prosecuted several negotiators for conspiring with cybercriminals. In October, MonsterCloud CEO Zohar Pinhasi was charged with wire fraud for allegedly charging customers $19 million while secretly paying hackers $8 million. Additionally, Angelo Martino was sentenced to 70 months in prison in July for conspiring with the Blackcat/ALPHV group to extort victims.
Sources: Krebs on Security.