The revelations come as law enforcement agencies move with uncommon speed to dismantle the infrastructure and leadership of ShinyHunters, a cybercrime brand that has extorted more than $70 million from victims globally in 2026 alone. Hackers aligned with the group have claimed credit for dozens of major data breaches dating back to 2019, when the operation was initially spearheaded by cybercriminals based in France. As those early members were systematically arrested or jailed, operational control over the ShinyHunters identity eventually shifted to “Rey,” a teenage hacker from Amman, Jordan, who was identified by researchers last year.
The pressure on the group intensified dramatically in late September, when ShinyHunters breached the FBI recruitment website, fbijobs.gov. The attackers taunted federal law enforcement by threatening to publish sensitive internal files, which reportedly included medical and psychological records, Social Security numbers, home addresses, and details regarding individual employee specializations and units.
The cyberattack on the FBI jobs portal triggered a rapid, aggressive response, leading authorities to detain and question individuals who maintained communications with Rey and other suspects. On October 3, Reuters reported that Rey had been detained by Jordanian authorities and was actively cooperating with the FBI.
Rey’s ascension to the top of the hacking group had followed the sudden neutralization of a senior associate. On the evening of September 15, 2026, Dutch police executed a high-stakes arrest in the Netherlands, deploying flash-bang grenades to stun and apprehend convicted hacker and ShinyHunters suspect Pepijn van der Stap as he was actively logged into various online accounts.
According to sources close to the investigation, law enforcement officers seized Van der Stap while he was utilizing his Signal instant messaging application. This immediate physical access allowed investigators to review recent communications with frequent contacts, including ransomware negotiators operating out of Canada and the United States.
Multiple sources with knowledge of the matter revealed that Van der Stap’s Signal message logs provided the breakthrough needed to unravel a disturbing murder-for-hire plot that surfaced immediately following his arrest. Dutch news outlet RTL reported last month that two murders were allegedly planned to be carried out abroad, with investigators finding indications that Van der Stap issued the orders for the attacks, though there is no evidence those directives were ever executed.
The digital footprint left behind by the Dutch hacker ultimately led to direct criminal charges against prominent industry figures. On October 9, KrebsOnSecurity broke the news that the FBI had arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the ongoing ShinyHunters probe. Dubrovsky, who recently published a book on handling cyber extortion that advised victims to always engage with hackers, was charged with threatening to disclose hacked data and interfering with interstate commerce through extortion, according to federal court records. Prosecutors requested that Dubrovsky remain in custody pending trial, and case records have been placed under seal.
Investigators analyzing Van der Stap’s decrypted communications discovered that he maintained frequent contact with Dubrovsky and at least one executive at a major U.S.-based consulting firm. Remarkably, these executives often possessed detailed knowledge of fresh ShinyHunters cyberattacks and data thefts before the victim organizations themselves were even aware they had been breached. Furthermore, federal investigators uncovered evidence indicating that Dubrovsky knew ShinyHunters had exfiltrated highly sensitive personnel data from FBI servers long before the extortionists publicly threatened to publish the files on social media platforms like X, yet he never notified the bureau.
SHINYWIRE
As the probe widened, investigators turned their attention to the digital infrastructure used by the hackers to coerce corporate victims. Sources close to the ShinyHunters investigation revealed that federal authorities believe at least one executive at a U.S.-based consulting firm played an active role in operating "shinywire[.]com," a now-defunct extortion portal. While investigators have identified the firm—a prestigious organization with more than 1,000 associates—media reports have withheld the names of the company and the specific executive pending formal criminal charges.
The Shinywire platform remained active from approximately May 3 until October 16, listing nearly 100 organizations compromised by ShinyHunters. Each entry on the site pressured victim companies to initiate contact with the cybercrime syndicate to negotiate payment terms, supplementing their demands with samples of stolen files and explicit warnings that the full cache would be leaked online if demands were ignored. Among the organizations targeted on the site was Intuitive Surgical, an American medical technology company breached in March 2026 after an employee fell victim to a targeted phishing email campaign.
Under the group’s extortion model, victim enterprises that failed to engage or negotiate within seven days saw their stolen data published on the ShinyHunters victim-shaming blog, which was accessible exclusively via the Tor anonymity network.
The fallout from the investigation has also exposed deep-seated fractures within the upper echelons of the cybersecurity industry. In mid-October, The Globe and Mail reported that months prior to his arrest, Edward Dubrovsky had filed a lawsuit in Ontario against Daniel Tobok, the former chief executive of Cypfer, a prominent cybersecurity firm with global offices. The two men initially partnered in 2017 to build Cypfer, where Dubrovsky served as a managing partner and chief operating officer. However, by 2024, their professional relationship deteriorated, with Dubrovsky alleging in court filings that Tobok gradually edged him out of business operations and made increasingly capricious decisions.
Tobok denied the allegations and filed a counterclaim accusing Dubrovsky of accessing confidential information and engaging in unfair competition through another venture, CyberSteward Inc., while allegedly misrepresenting his status as a Cypfer founder and non-shareholder.
GHOSTBYTE
Interviews with former colleagues of Daniel Tobok indicate that years prior to these corporate disputes, he was known among ransomware actors by a specific moniker: Ghostbyte. In 2018, a Canadian company targeted by Dharma—a prolific Russian-language ransomware affiliate program launched in 2016—informed the hackers that they were inclined to pay the ransom to recover locked files, provided they could secure a guarantee that the extortionists would honor their word.
In email correspondence reviewed by investigators, the Dharma representative directed the victim toward a Canadian IT firm capable of securing such guarantees, explicitly recommending that they contact the email address [email protected]. The Dharma representative wrote that the IT company routinely resolved such issues in Canada, advising the victim to establish a formal service contract.
While it remains unclear whether Tobok actively utilized the Ghostbyte email address provided by the ransomware affiliate, breach-tracking service Constella Intelligence found that an email address frequently used by Tobok—[email protected]—was linked to online accounts utilizing the username "ghostbyte," including a Snapchat profile. Constella’s analysis also tied the Dharma representative’s email address to a cryptocurrency wallet that processed dozens of transactions totaling roughly 43 bitcoin, valued at approximately $3.5 million at current market rates, with its final transaction recorded in February 2019.
Representatives for Cypfer stated that the firm does not facilitate ransomware payments and noted that management only learned of Dubrovsky’s arrest through media reports. Cypfer emphasized that it had no prior knowledge of the arrest, had received no outreach from law enforcement, and was not the target of any federal investigation. The company added that CyberSteward and Cypfer operate as entirely separate entities with no shared officers, directors, or employees, and pointed out that Cypfer was recently acquired by the Apros Group, a holding company led by former FBI special agent and Aon Cyber Solutions Group CEO Jason Hogg. Aon had previously acquired Cytelligence, a security consulting firm where Tobok served as founder and CEO and Dubrovsky operated as a managing partner.
CONFLICTING INTERESTS
Paying a ransom to recover encrypted data or prevent the publication of stolen files is not inherently illegal under U.S. law, provided the victim does not transact with a terrorist organization or a group sanctioned by the U.S. Treasury Department. ShinyHunters is not currently subject to government sanctions.
Ransomware victims are frequently guided by cyber insurance providers to engage specific incident response firms. However, because many reputable forensics firms refuse to facilitate ransom payments on ethical or strategic grounds, victim companies frequently replace them with negotiators willing to meet extortion demands.
The landscape is further complicated by financial incentives. In December 2024, ShinyHunters targeted educational technology firm PowerSchool, stealing private records belonging to millions of students and teachers across the U.S. and Canada. PowerSchool reportedly paid a $2.85 million ransom with assistance from CyberSteward, though the payment failed to prevent subsequent extortion waves targeting individual school districts using the same stolen dataset.
Leading incident response firms such as Coveware and Unit 221B have consistently urged victims not to pay ShinyHunters, warning that extortionists routinely retain, resell, or weaponize stolen data despite promises of deletion. The FBI issued similar guidance in a public service announcement, advising against capitulation.
Internal communications reviewed by investigators underscore the friction between the hackers and advisory firms attempting to disrupt their business model. Private Telegram chats from May 2026 reveal ShinyHunters leaders complaining bitterly that Coveware’s public warnings were depressing their payment rates. In one message, the primary ShinyHunters account lamented that companies would have paid were it not for Coveware’s "misinformation," adding that the group was actively looking to "eliminate the problem." Coveware declined to comment on the matter.
Mark Camillo, chief executive of CyberAcuView—an industry consortium established by major cyber insurance carriers in 2021—pointed out that some negotiation firms operate on a fee structure tied to a percentage of the final ransom payout. Camillo noted that this model introduces an inherent conflict of interest, giving negotiators a financial incentive to encourage payouts and discourage aggressive downward bargaining.
Recent federal prosecutions underscore these concerns. On October 7, the Department of Justice charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy, alleging that he charged customers millions for remediation while secretly paying hackers behind their clients’ backs. Similarly, in July, Florida-based ransomware negotiator Angelo Martino was sentenced to 70 months in prison for conspiring with the BlackCat/ALPHV ransomware syndicate to extort victims by passing confidential negotiation strategies directly to the hackers to maximize payouts.
