U.S. federal investigators pursuing the notorious ShinyHunters hacking group—which recently shocked the cybersecurity community by stealing highly sensitive data from the FBI—have identified executives at two different ransomware negotiation firms who maintained unusually close and illicit relations with the extortion syndicate. According to sources close to the unfolding investigation, one of these executives based in the United States even went so far as to help ShinyHunters operate a dedicated pressure website designed to coerce corporate victims into paying multimillion-dollar ransoms.
Hackers aligned with the ShinyHunters banner have claimed responsibility for dozens of major data breaches and high-profile corporate extortion schemes since 2019. In its early days, the collective was primarily operated by cybercriminals residing in France. However, as those original members were systematically identified, arrested, and jailed by international law enforcement agencies, control over the ShinyHunters brand eventually shifted to a young administrator known online as “Rey.” Last year, investigators identified Rey as a teenage hacker operating out of Amman, Jordan. According to official figures released by the FBI, the rejuvenated ShinyHunters syndicate has successfully extorted more than $70 million from corporate and government victims so far this year alone.
The group’s brazen activities reached a fever pitch in late September, when hackers tied to ShinyHunters successfully breached the FBI recruitment portal, fbijobs.gov. The attackers taunted federal authorities by threatening to publish a cache of deeply sensitive stolen files. Reports indicate the compromised data included confidential medical and psychological records, Social Security numbers, home addresses, and specific details regarding the operational units and specializations of bureau employees.
The targeted hack of the FBI jobs portal prompted the federal agency to move with uncommon speed and aggression, arresting, detaining, and questioning individuals who had maintained any digital communications with Rey or other suspected members of the ShinyHunters network. On October 3, Reuters reported that Rey had been detained by Jordanian authorities and was actively cooperating with the FBI.
Rey had been able to assume operational control over the hacking group because one of its primary senior members had just been neutralized. On the evening of September 15, 2026, law enforcement authorities in the Netherlands executed a dramatic tactical raid, arresting convicted hacker and prominent ShinyHunters suspect Pepijn van der Stap. Dutch police reportedly deployed flash-bang grenades to stun and apprehend Van der Stap while he was actively logged into various online accounts.
According to sources close to the international investigation, authorities apprehended Van der Stap while he was actively using his Signal instant messaging account. This tactical advantage allowed investigators to immediately access and review recent communications with frequent contacts, including ransomware negotiators based in Canada and the United States.
Multiple well-placed sources with direct knowledge of the matter told KrebsOnSecurity that Van der Stap’s recovered Signal messages proved critical in unraveling an alarming murder-for-hire plot that surfaced immediately following his arrest. The Dutch news outlet RTL reported last month that two contract murders were allegedly planned to be carried out abroad, with compelling indications suggesting Van der Stap had issued the orders for the attacks, though there is no evidence indicating those violent directives were ever executed.
On October 9, KrebsOnSecurity broke the news that the FBI had arrested a 54-year-old Canadian cybersecurity executive named Edward Dubrovsky in connection with the broadening ShinyHunters investigation. Dubrovsky, who recently published a book on handling corporate cyber extortion that explicitly recommended always engaging and negotiating with hackers, was formally charged with threatening to disclose stolen data and interfering with interstate commerce through extortion, according to federal court records. Politico reported that federal prosecutors requested Dubrovsky remain in custody pending trial, and that all records associated with his criminal case remain sealed from public view.
A confidential source close to the investigation revealed that Van der Stap’s Signal message logs demonstrated frequent, direct conversations between the Dutch hacker, Mr. Dubrovsky, and at least one executive at a prominent U.S.-based consulting firm. Remarkably, these communications showed that the executives often possessed detailed knowledge of new ShinyHunters corporate victims before the targeted organizations themselves had even discovered or confirmed the security breaches.
Furthermore, investigators uncovered what they described as a potentially explosive finding within the Dutch hacker’s chat logs: Mr. Dubrovsky was fully aware that ShinyHunters had successfully stolen deeply sensitive personnel data from official FBI servers, yet he never notified the bureau of the catastrophic data breach prior to ShinyHunters publicly threatening on Twitter/X to release the confidential files.
SHINYWIRE
Federal investigators probing the ShinyHunters network have also developed intelligence suggesting that at least one executive at a U.S.-based consulting firm played an active, hands-on role in operating the now-defunct ShinyHunters victim extortion portal, known as shinywire.com. While KrebsOnSecurity has chosen to withhold the specific names of the U.S. company and the suspected executive pending formal criminal charges, the firm in question is an elite organization employing more than 1,000 associates.
The Shinywire extortion website remained active from approximately May 3 until October 16, cataloging listings for nearly 100 corporate and institutional organizations compromised by ShinyHunters. Each entry on the portal urged victim companies to engage directly with the cybercrime syndicate to negotiate payment terms. To ramp up psychological pressure, the web pages featured samples of stolen proprietary files, accompanied by explicit warnings that the full data caches would be leaked publicly if the victim ignored the extortion demands.
Victim organizations that refused to engage in dialogue or negotiate a payout within a strict seven-day window invariably found all of their stolen records dumped onto the primary ShinyHunters victim-shaming blog, a dark web site accessible exclusively through the Tor anonymity network.
In a report published on October 15, The Globe and Mail revealed that several months prior to his arrest by the FBI, Edward Dubrovsky had alleged in Canadian court documents that he had become collateral damage in a malicious campaign orchestrated by a former business partner seeking to destroy another industry executive. Dubrovsky filed a lawsuit in Ontario earlier this year against Daniel Tobok, the former chief executive officer of Cypfer, a prominent cybersecurity firm founded in Toronto with international offices spanning the United States, Britain, the Netherlands, the United Arab Emirates, and Mexico.
The two men originally became business partners in 2017 and subsequently built Cypfer together, with Dubrovsky serving as a managing partner and chief operating officer. However, by 2024, their professional relationship had completely fractured. Dubrovsky accused Tobok of systematically marginalizing him from core business operations and making increasingly capricious corporate decisions.
Mr. Tobok fiercely denied the allegations, filing a formal counterclaim accusing Dubrovsky of misappropriating confidential information and engaging in unfair competition through parallel work at another firm called CyberSteward Inc. Tobok also maintained that Dubrovsky had repeatedly misrepresented himself as a founding member of Cypfer and held no actual equity stake in the company.
GHOSTBYTE
Interviews with several former colleagues of Mr. Tobok revealed that as far back as eight years ago, he was known among international ransomware purveyors by a distinct monicker: Ghostbyte. In 2018, a Canadian enterprise suffered a debilitating cyberattack orchestrated by Dharma, a prolific Russian-language ransomware affiliate program that first emerged in 2016. The victim organization informed the Dharma ransomware representative that they were leaning toward paying the ransom because critical operational files were permanently locked and unrecoverable, but they demanded stronger guarantees that the extortionists would honor their word upon payment.
A redacted copy of the Dharma representative’s email response advised the desperate victim to contact an individual at a Canadian IT firm that specialized in providing such assurances. Specifically, the cybercriminal recommended reaching out to the email address [email protected].
"If you want guarantees, you can write to the IT company," the Dharma operator advised in the correspondence. "Take the phone and negotiate with them. This IT company often solves such problems in Canada. You can contact them and sign a contract for services. You’ll still have to pay."
While it remains unclear whether Mr. Tobok personally utilized the Ghostbyte email address provided by the Dharma affiliate—and he has not responded to multiple requests for comment—threat intelligence analysis from Constella Intelligence uncovered a compelling digital link. Constella’s records indicate that an email address frequently used by Mr. Tobok, [email protected], is directly associated with two distinct online accounts where the chosen username was "ghostbyte," including a personal Snapchat profile.
Furthermore, Constella discovered that the Dharma representative’s contact email, [email protected], is linked to a specific cryptocurrency wallet address that historically processed 38 transactions totaling 43 bitcoins—valued at approximately $3.5 million at current exchange rates. The most recent transaction recorded for this specific blockchain wallet is dated February 2019.
In an official corporate statement issued on October 14, Cypfer asserted that its business model does not involve making or facilitating ransom payments on behalf of clients. The company stated that it learned of Dubrovsky’s federal arrest only when the news broke across mainstream media outlets.
"We had no prior knowledge of Mr. Dubrovsky’s arrest," a Cypfer spokesperson stated via email. "CYPFER has not received any outreach from law enforcement and, to our knowledge, is not the target of any law enforcement investigation."
The statement further clarified that CyberSteward and Cypfer operate as entirely separate entities with no overlapping officers, directors, or employees. Cypfer was recently acquired by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. In 2020, Aon had acquired Cytelligence, a security consulting firm where Mr. Tobok served as founder and CEO, and Mr. Dubrovsky operated as a managing partner.
CONFLICTING INTERESTS
Under United States federal law, it is not inherently illegal for a victimized organization to pay hackers in exchange for a decryption key to unlock operational servers, or for a promise to delete stolen files and refrain from publishing them online. While corporate victims can find themselves in severe legal trouble if they disburse funds to a ransomware group currently designated under sanctions by the U.S. Treasury Department, ShinyHunters is not listed among the sanctioned entities by the U.S. government or international authorities.
Cybersecurity experts note that organizations struck by ransomware are typically guided by their cyber insurance providers to retain specific incident response and remediation firms. However, not all digital forensics and breach response companies agree to facilitate extortion payments to criminal syndicates. Consequently, when victimized enterprises decide to pay, firms that refuse to reward cybercriminals are frequently sidelined and replaced by less scrupulous entities willing to handle the transaction.
In December 2024, ShinyHunters initiated an extortion campaign against PowerSchool, an educational technology company, stealing private records belonging to 62 million students and 9.5 million teachers across the United States and Canada. PowerSchool reportedly paid a $2.85 million ransom demand. Publicly available compliance documentation indicates that PowerSchool was assisted in its remediation efforts by CyberSteward. (A 20-year-old ShinyHunters affiliate from Sterling, Massachusetts, named Matthew Lane, was subsequently sentenced in November 2025 to four years in federal prison for his admitted role in the PowerSchool intrusion.)
Despite the multi-million dollar payout, the ransom did not prevent subsequent waves of extortion utilizing the exact same stolen dataset. By May 2025, individual school districts began receiving independent ransom demands accompanied by samples of the stolen records. Although no law enforcement agency formally alleged that ShinyHunters orchestrated the secondary extortion wave against individual schools, the incident underscored a brutal reality in modern cybersecurity: there is no technical mechanism to verify that threat actors have truly deleted stolen data as promised, nor can victims prevent third parties from abusing compromised records.
A number of leading incident response firms, including Coveware and Unit 221B, have consistently warned corporate victims against paying ransoms to ShinyHunters, publicly emphasizing that "destroyed" victim data is routinely retained, resold, or leveraged directly against a company’s downstream clients.
The FBI echoed those warnings in an official public service announcement on May 15, advising organizations against capitulating to ShinyHunters’ demands. Meanwhile, leaders of the cybercrime collective have responded with relentless harassment and online threats directed at employees of Coveware and Unit 221B for providing such guidance.
Internal communications reviewed by federal investigators reveal deep frustration among ShinyHunters leaders regarding Coveware’s public warnings. In a private Telegram conversation on May 6 between the main ShinyHunters account administrator and an unindicted co-conspirator, the hackers complained that Coveware was actively sabotaging their monetization rates.
"Go on my website, majority of those companies would’ve paid if it weren’t for Coveware giving them misinformation," the ShinyHunters administrator wrote. "Someone (100% Coveware) is going out of their way to make sure I am not paid."
In an earlier chat dated April 11, the same ShinyHunters account noted that they were actively attempting to "eliminate the problem," explicitly identifying Coveware as the obstacle impeding their extortion revenue. Coveware declined to comment when contacted regarding these threats.
Mark Camillo, chief executive of CyberAcuView—an industry consortium established in 2021 by major cyber insurance carriers—explained that compensation structures within the incident response sector create structural vulnerabilities. While some firms charge a flat retainer fee, those specializing in direct ransom negotiations often charge a sliding fee calculated as a percentage of the final ransom payout.
Camillo noted that this business model introduces an inherent conflict of interest, as negotiators possess a clear financial incentive to keep terms favorable to the attackers, discouraging aggressive pushback or downward negotiation on the price.
"It has come to the industry’s attention that many of the ransomware payers charge a percentage of the final payment which may or may not be disclosed," Camillo said. "This makes no sense if they are also the negotiator. There needs to be more transparency in the process as no one in the ecosystem should be profiting purely on the size of the ransomware transaction or payment itself."
Camillo added that firms offering negotiation services often argue that higher fees are necessary to cover the unpredictable costs of acquiring large volumes of cryptocurrency, managing financial float, and absorbing elevated exchange fees associated with high-risk transactions. "There definitely needs to be more visibility around the transaction and clarity on the increasing value of the crypto and the exchange’s percent in the transaction to get to the bottom of this and remove any misaligned incentives," he stated.
In recent months, the U.S. Department of Justice has aggressively stepped up prosecutions against ransomware negotiators accused of conspiring with criminal syndicates to defraud their own clients. On October 7, the DOJ charged MonsterCloud CEO Zohar Pinhasi, 50, with wire fraud and conspiracy for allegedly charging corporate customers exorbitant fees to remediate ransomware attacks without paying hackers, while secretly disbursing $8 million to cybercriminals behind their clients’ backs while billing customers a total of $19 million.
Similarly, in July, Angelo Martino, a 41-year-old ransomware negotiator based in Land O’Lakes, Florida, was sentenced to 70 months in federal prison for conspiring with the BlackCat/ALPHV ransomware group to extort multiple corporate victims. According to federal prosecutors, Martino was compensated by the BlackCat hackers to siphon confidential information regarding the negotiating strategies and tactical positions of his employer’s clients, directly enabling the cybercriminals to maximize their extortion payouts.
