U.S. federal investigators pursuing the prolific ShinyHunters hacking group—which recently executed a high-profile data theft targeting the FBI—have identified senior executives at two separate ransomware negotiation firms who maintained unusually close and illicit relations with the extortion syndicate. Sources close to the ongoing federal investigation revealed that one of the executives, operating within the United States, actively assisted ShinyHunters in operating a dedicated pressure website designed to coerce corporate victims into paying multimillion-dollar ransoms.
Hackers aligned with the ShinyHunters banner have claimed credit for dozens of major data breaches dating back to 2019, an era when the collective was primarily operated by cybercriminals residing in France. As those founding members were systematically apprehended and imprisoned by international law enforcement, control over the ShinyHunters brand eventually transitioned to "Rey," an administrator identified last year as a teenage hacker based in Amman, Jordan. According to federal estimates provided by the FBI, the ShinyHunters network has successfully extorted more than $70 million from victims globally over the course of the year.
The group’s operational audacity peaked in late September when ShinyHunters compromised the FBI recruitment portal, fbijobs.gov, subsequently taunt-publishing and threatening to release deeply sensitive files. The stolen trove reportedly included employee medical and psychological records, Social Security numbers, residential addresses, and specific unit assignments. This brazen breach of a premier federal law enforcement agency prompted an accelerated international response, leading authorities to aggressively detain and question individuals who communicated directly with Rey or other key suspects. Notably, Reuters reported that Rey had been detained by Jordanian authorities and was actively cooperating with federal investigators.
Rey’s consolidation of power over the hacking collective followed the abrupt neutralization of a senior associate. On the evening of September 15, Dutch law enforcement authorities arrested convicted hacker and primary ShinyHunters suspect Pepijn van der Stap. Police reportedly deployed flash-bang grenades to stun and apprehend Van der Stap while he remained actively logged into multiple online accounts. Sources close to the investigation noted that the suspect was intercepted while utilizing his Signal instant messaging account, granting investigators immediate access to active communication threads with frequent contacts, including ransomware negotiators stationed in Canada and the United States.
Multiple well-informed sources confirmed that Van der Stap’s decrypted messages served as the pivotal breakthrough in unraveling a chilling murder-for-hire plot that surfaced immediately following his apprehension. Dutch media outlet RTL reported that two murders were allegedly commissioned to be carried out abroad, with compelling indications that Van der Stap issued the directives, though authorities stress there is no evidence those violent orders were ever executed.
The digital trail soon led directly to executive suites within the cyber extortion response industry. On October 9, federal authorities arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the sprawling ShinyHunters investigation. Dubrovsky, who recently published a book on handling cyber extortion that explicitly advocated for maintaining communication with threat actors, faces federal charges of threatening to disclose stolen data and interfering with interstate commerce through extortion, according to federal court records. Prosecutors requested that Dubrovsky remain in custody pending trial, with related case records placed under seal.
Investigative sources revealed that Van der Stap’s Signal archive featured frequent, detailed exchanges with Dubrovsky and an executive at a major U.S.-based consulting firm. These communications demonstrated that the negotiators frequently possessed precise details regarding newly breached ShinyHunters victims before the victim organizations themselves had even detected the intrusions. Furthermore, federal investigators uncovered that Dubrovsky was fully aware that ShinyHunters had exfiltrated highly sensitive data from FBI servers yet failed to notify the bureau prior to the group’s public extortion threats on social media.
SHINYWIRE
In a significant expansion of the probe, sources close to the ShinyHunters investigation disclosed that federal agents believe at least one executive at a prominent U.S.-based consulting firm played an active operational role in running shinywire[.]com, a now-defunct victim extortion portal. Although investigators have identified the firm—which employs more than 1,000 associates—law enforcement has temporarily withheld public disclosure of the company and specific executives pending formal criminal charges.
The Shinywire platform operated openly from approximately May 3 until October 16, cataloging nearly 100 corporate organizations compromised by ShinyHunters. Each entry functioned as an aggressive coercion tool, urging targeted entities to negotiate payment terms, displaying samples of compromised proprietary data, and warning that the full cache would be leaked publicly if demands were ignored. Archived records demonstrate how the site targeted organizations such as Intuitive Surgical, an American medical technology firm breached after an employee fell victim to a targeted phishing campaign. Under the group’s operational model, corporate victims who refused to engage within a strict seven-day window faced the publication of their stolen archives on the group’s dedicated Tor-hosted shaming blog.
Legal and industry maneuverings surrounding these arrests have further complicated the corporate landscape. Reports indicated that Dubrovsky had filed a civil lawsuit in Ontario earlier in the year against Daniel Tobok, the former chief executive of Cypfer, a Toronto-founded cybersecurity firm with international offices. Dubrovsky alleged that he had been made collateral damage in a campaign by a former business partner seeking to destroy industry rivals following a falling out over strategic decisions. Tobok denied the allegations through legal filings, launching counterclaims accusing Dubrovsky of misappropriating confidential information and competing unfairly via another entity, CyberSteward Inc.
GHOSTBYTE
As investigators probe deeper into the financial and operational scaffolding supporting ransomware syndicates, former colleagues have pointed to historical ties linking key industry figures to early threat actors. Interviews with associates of Daniel Tobok revealed that as far back as eight years ago, he was recognized within ransomware circles by the alias "Ghostbyte." In 2018, a Canadian enterprise compromised by Dharma—a prolific, Russian-language ransomware affiliate program—sought guarantees that the threat actors would honor decryption and data-deletion agreements.
Redacted communications from the Dharma representative directed the desperate victim to contact an IT professional associated with the email address [email protected], assuring them that the designated contact routinely resolved such dilemmas for Canadian corporations. While it remains unclear whether Tobok personally utilized the Ghostbyte address, breach-tracking intelligence analyzed by Constella Intelligence linked a frequently used personal email address belonging to Tobok, [email protected], to online accounts utilizing the "ghostbyte" username, including Snapchat. Furthermore, intelligence feeds connected the Dharma representative’s wallet to cryptocurrency transactions totaling tens of bitcoins.
In response to public scrutiny, Cypfer issued formal statements emphasizing that its corporate remit does not involve facilitating ransomware payments and asserting that leadership learned of Dubrovsky’s arrest exclusively through media reports. The firm noted that it has received no outreach from law enforcement and maintains no corporate relationship with CyberSteward, highlighting its recent acquisition by the Apros Group, a holding company led by former FBI special agent Jason Hogg.
CONFLICTING INTERESTS
The intersection of incident response firms, ransomware negotiation practices, and criminal extortion has drawn intense scrutiny from the U.S. Department of Justice and regulatory bodies. While paying a ransom to unlock encrypted systems or secure a promise of data deletion is not inherently illegal under U.S. law—provided the group is not designated as a sanctioned entity by the U.S. Treasury Department—the financial incentives governing the negotiation ecosystem have created profound conflicts of interest.
Many corporate victims rely on insurance-mandated incident response firms to handle cyber crises. However, because specialized negotiation firms frequently charge a commission scaled as a percentage of the total ransom paid, industry watchdogs warn these intermediaries possess a direct financial incentive to inflate ransom payouts rather than negotiate reductions. Mark Camillo, chief executive of cyber insurance industry group CyberAcuView, emphasized that no entity within the security ecosystem should profit proportionally from the size of a criminal extortion payment.
Federal prosecutors have increasingly targeted rogue negotiators who abuse their positions of trust. The DOJ charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy for allegedly billing clients for remediation services while secretly paying hackers millions behind their clients’ backs. Similarly, Florida-based ransomware negotiator Angelo Martino was sentenced to 70 months in prison for conspiring with the BlackCat/ALPHV syndicate to extract confidential client negotiation strategies, thereby maximizing extortion payouts at the expense of victim organizations.
