U.S. federal investigators pursuing the prolific ShinyHunters hacking group—which recently compromised highly sensitive data belonging to the Federal Bureau of Investigation—have identified executives at two different ransomware negotiation firms who maintained unusually close relationships with the cyberextortion syndicate. Sources close to the ongoing investigation indicate that one of these U.S.-based executives actively assisted ShinyHunters in operating a website designed to pressure victim organizations into paying ransom demands.
Hackers aligned with ShinyHunters have claimed responsibility for dozens of major corporate and institutional data breaches since 2019, a period when the group was primarily operated by cybercriminals residing in France. As those original members were systematically apprehended and jailed, operational control over the ShinyHunters brand eventually transitioned to an individual known as “Rey.” Last year, authorities identified Rey as a teenage hacker based in Amman, Jordan. According to estimates from the FBI, the syndicate has successfully extorted more than $70 million from corporate and government victims so far this year.
The escalation in federal scrutiny follows a brazen breach in late September, when ShinyHunters compromised the FBI recruitment portal, fbijobs.gov. The hackers taunted federal law enforcement by threatening to publish a cache of stolen internal files. Reports indicate the compromised material included confidential medical and psychological records, Social Security numbers, home addresses, and detailed information regarding individual employee specializations and organizational units.
The compromise of the recruitment website prompted the FBI to act with exceptional speed, moving to arrest, detain, and question individuals who maintained communications with Rey or other suspects linked to ShinyHunters. On October 3, Reuters reported that Rey had been detained by authorities in Jordan and was actively cooperating with federal investigators.
Rey’s consolidation of power over the hacking collective followed the disruption of another senior operative. On the evening of September 15, law enforcement officers in the Netherlands arrested Pepijn van der Stap, a convicted hacker and primary suspect in the ShinyHunters investigation. Dutch police reportedly deployed flash-bang grenades to stun and apprehend Van der Stap while he remained actively logged into various online accounts.
According to sources close to the inquiry, authorities seized Van der Stap at a moment when he was utilizing his Signal instant messaging account. This tactical advantage enabled investigators to access recent communications with frequent contacts, including ransomware negotiators operating out of Canada and the United States.
Multiple knowledgeable sources revealed that Van der Stap’s Signal communications proved pivotal in unraveling a murder-for-hire plot that surfaced immediately following his apprehension. Last month, Dutch media outlet RTL reported that two murders were allegedly planned to be executed abroad, with indications pointing to Van der Stap as the individual who issued the orders, though law enforcement found no evidence that the plots were ever carried out.
On October 9, the investigation crossed a major threshold when the FBI arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the ShinyHunters probe. Dubrovsky, who recently authored a book on handling cyber extortion that advised victims to consistently engage with threat actors, was formally charged with threatening to disclose stolen data and interfering with interstate commerce through extortion, according to federal court records. Prosecutors requested that Dubrovsky remain in custody pending trial, and court records associated with the case have been placed under seal.
Investigative sources reported that Van der Stap’s Signal message logs revealed frequent conversations between the Dutch hacker, Dubrovsky, and at least one executive at a prominent U.S.-based consulting firm. These discussions demonstrated that the executives often possessed detailed knowledge of newly targeted victims before the victim organizations themselves were even aware of the security breaches.
Furthermore, investigators uncovered evidence indicating that Dubrovsky was aware ShinyHunters had successfully extracted sensitive data from FBI servers. Despite this knowledge, he allegedly failed to inform the bureau prior to the syndicate publicly threatening on social media to publish the agency’s deeply personal personnel records.
SHINYWIRE
As the probe widened, investigators discovered that at least one executive at a U.S.-based consulting firm played an active operational role in maintaining the now-defunct ShinyHunters victim extortion website, known as shinywire[.]com. While law enforcement has not yet filed formal criminal charges against the individual or the firm—a prestigious organization with more than 1,000 associates—authorities have mapped out the infrastructure of the site.
The Shinywire platform remained active from approximately May 3 until October 16, cataloging nearly 100 organizations compromised by ShinyHunters. Each entry on the portal urged victim entities to initiate discussions with the cybercrime collective regarding payment terms. The pages also featured samples of stolen data alongside warnings that the files would be permanently leaked online if ransom demands were ignored.
Cached records from monitoring services such as urlscan.io captured extortion listings targeting high-profile entities, including Intuitive Surgical, an American medical technology company breached in March after an employee fell victim to a targeted phishing campaign. Under the extortion scheme, victim organizations that refused to engage within a seven-day window found their stolen records published on the primary ShinyHunters shaming blog, which is accessible exclusively via the Tor anonymity network.
The legal and professional fallout surrounding these networks has extended into civil courts. In mid-October, reports surfaced that Dubrovsky had previously filed a lawsuit in Ontario against Daniel Tobok, the former chief executive of Cypfer, a Toronto-founded cybersecurity firm with international offices. Dubrovsky alleged that he had been made collateral damage in a campaign by a former business partner seeking to damage another industry executive. The two men, who helped build Cypfer together after partnering in 2017, experienced a falling out by 2024, with Dubrovsky accusing Tobok of marginalizing him from corporate decisions. Tobok denied the allegations, filing a counterclaim accusing Dubrovsky of accessing confidential information and competing unfairly through another entity called CyberSteward Inc.
GHOSTBYTE
Historical analysis of threat actor communications revealed further connections within the cyberextortion ecosystem. Interviews with former colleagues of Tobok indicated that as far back as eight years ago, he was known to ransomware actors by the nickname Ghostbyte. In 2018, following an intrusion by the Dharma ransomware affiliate program, a Canadian victim company reported needing guarantees that the hackers would honor their word if a ransom was paid. In response, a Dharma representative directed the victim to an IT company in Canada, recommending contact with the email address [email protected].
While it remains unverified whether Tobok actively used the Ghostbyte address, breach-tracking intelligence from Constella Intelligence indicates that an email address frequently used by Tobok—[email protected]—was linked to online profiles utilizing the username ghostbyte, including a Snapchat account. Additional analysis tied the Dharma representative’s email address to a cryptocurrency wallet that processed dozens of transactions worth millions of dollars.
Cypfer issued a statement clarifying that the firm does not facilitate ransomware payments and maintained no prior knowledge of Dubrovsky’s arrest. The company noted that it operates independently of CyberSteward and has recently been acquired by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group.
CONFLICTING INTERESTS
Under U.S. law, paying a ransom to recover encrypted systems or secure the deletion of stolen files is not inherently illegal, provided the threat actor is not subject to U.S. Treasury Department sanctions. Although ShinyHunters is not currently sanctioned, the ecosystem surrounding ransomware negotiation remains fraught with ethical and legal complications.
Many corporate victims are directed by insurance providers to specialized incident response firms. However, because some forensics firms refuse to facilitate extortion payments, clients frequently transition to companies willing to handle transactions with hackers. In several high-profile instances, this dynamic has created severe conflicts of interest. Security experts and industry leaders have noted that negotiators who charge a percentage of the total ransom payment have a direct financial incentive to encourage payouts and discourage aggressive price negotiations.
Recent federal prosecutions have targeted individuals accused of exploiting these arrangements. The Department of Justice charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy for allegedly charging clients for remediation while secretly paying hackers millions behind their clients’ backs. Similarly, a Florida-based ransomware negotiator was sentenced to prison for conspiring with the Blackcat/ALPHV syndicate to provide confidential negotiation strategies that maximized payouts.
As federal investigations continue into the operational networks supporting groups like ShinyHunters, authorities are scrutinizing the intersection of corporate incident response, ransomware negotiation, and the illicit networks that sustain cyberextortion enterprises worldwide.
