U.S. federal investigators pursuing the prolific ShinyHunters hacking group—which recently executed a high-profile data theft targeting the Federal Bureau of Investigation (FBI)—have identified senior executives at two separate ransomware negotiation firms who maintained unusually close and suspicious relations with the extortion syndicate. Sources close to the active federal investigation reveal that one of these U.S.-based executives even went so far as to actively help ShinyHunters operate a dedicated public website designed to pressure corporate victims into paying multimillion-dollar ransoms.
Hackers aligned with the ShinyHunters brand have claimed credit for dozens of major enterprise data breaches since the group first emerged in 2019, an era when the operation was primarily run by cybercriminals residing in France. As those original founding members were systematically arrested, prosecuted, and jailed one by one, control over the lucrative ShinyHunters moniker ultimately transitioned to a young operator known online as "Rey." Last year, federal law enforcement and cybersecurity researchers identified Rey as a teenage hacker operating out of Amman, Jordan. According to official estimates from the FBI, ShinyHunters has successfully extorted more than $70 million from corporate and institutional victims over the course of the year alone.
The group’s brazen activities reached a dramatic peak in late September, when hackers associated with ShinyHunters successfully breached the FBI recruitment portal, fbijobs.gov. The attackers immediately taunted federal law enforcement by threatening to publicly release a cache of sensitive stolen files. Reports indicate the compromised data included deeply private medical and psychological records, Social Security numbers, home addresses, and internal administrative information detailing the unit specializations of bureau personnel.
The direct compromise of an official FBI jobs portal prompted the bureau to move with uncommon speed, arresting, detaining, and questioning individuals who maintained any historical communications with Rey or other key ShinyHunters suspects. Reuters reported on October 3 that Rey had been detained by Jordanian authorities and was actively cooperating with the FBI’s ongoing investigation.
Rey’s ability to seize control of the fragmented hacking collective came in the wake of another major international law enforcement disruption. On the evening of September 15, law enforcement officers in the Netherlands executed a high-stakes raid, arresting convicted hacker and primary ShinyHunters suspect Pepijn van der Stap. Dutch police reportedly deployed flash-bang grenades to stun and apprehend Van der Stap precisely while he remained actively logged into various critical online accounts.
According to sources close to the unfolding investigation, Dutch authorities managed to seize Van der Stap while he was actively using his Signal instant messaging application. This tactical breach allowed investigators to immediately review recent real-time communications with his most frequent contacts, including specialized ransomware negotiators operating out of Canada and the United States.
Multiple knowledgeable sources confirmed to investigators that Van der Stap’s recovered Signal messages proved instrumental in unraveling a disturbing murder-for-hire plot that surfaced immediately following his capture. The Dutch news outlet RTL reported that the alleged murder plot involved two targeted attacks to be carried out abroad, with strong indications from chat records that Van der Stap had issued the orders, though there is no evidence indicating the plots were ever actually carried out.
On October 9, breaking news revealed that the FBI had arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the sprawling ShinyHunters investigation. Dubrovsky, who recently published a book detailing strategies for handling cyber extortion and consistently recommended that victims engage directly with hackers, was formally charged with threatening to disclose stolen data and interfering with interstate commerce through extortion, according to federal court records. Politico reported that federal prosecutors requested Dubrovsky remain in custody pending trial, and that all associated court records be kept under seal.
A source close to the investigation disclosed that Van der Stap’s Signal message archives revealed frequent, detailed conversations between the Dutch hacker, Dubrovsky, and at least one executive at a major U.S.-based consulting firm. Remarkably, these executives often possessed inside knowledge regarding fresh ShinyHunters victims even before the targeted corporations had discovered or realized they had suffered a data breach.
That same source shared another potentially explosive discovery made by federal investigators: the Dutch hacker’s chat logs demonstrated that Dubrovsky was fully aware that ShinyHunters had exfiltrated highly sensitive personnel data directly from FBI servers. Despite this knowledge, Dubrovsky never notified the bureau of the catastrophic security breach prior to ShinyHunters publicly announcing and threatening the release of the deep-seated personnel records on social media platforms.
SHINYWIRE
Investigators pursuing the ShinyHunters network believe that at least one executive at a prominent U.S.-based consulting firm played an active, operational role in managing the now-defunct ShinyHunters victim extortion web portal known as "shinywire.com." While federal authorities have not yet formally filed criminal charges against the U.S. company or the specific executive involved, the firm is known to be a prestigious organization employing more than 1,000 professional associates.
The Shinywire domain was active from approximately May 3 through October 16, serving as an aggressive shaming and extortion platform that listed nearly 100 corporate and institutional organizations compromised by ShinyHunters. Each entry on the site pressured victim entities to initiate direct dialogue with the cybercrime syndicate to negotiate payment terms. The web pages featured explicit samples of stolen corporate data, accompanied by explicit warnings that the full trove of files would be published online if the victim ignored ransom demands.
Cached data indexed by security monitoring services highlighted extortion demands targeting major enterprises like Intuitive Surgical, an American medical technology company that suffered a network breach earlier in the year after an employee fell victim to a targeted phishing email attack. Under the mechanics of the scheme, victim organizations that refused to engage in negotiations within a strict seven-day window found all of their proprietary and stolen data leaked on the primary ShinyHunters shaming blog, which was hosted exclusively on the anonymous Tor network.
As the legal and investigative net widened, media outlets reported on underlying commercial conflicts. A report by The Globe and Mail revealed that months prior to his federal arrest, Edward Dubrovsky had filed a lawsuit in Ontario alleging he had become collateral damage in an aggressive campaign by a former business partner seeking to destroy another industry executive.
Court documents showed Dubrovsky had sued Daniel Tobok, the former chief executive of Cypfer, a prominent Toronto-founded cybersecurity firm with international offices spanning the United States, Britain, the Netherlands, the United Arab Emirates, and Mexico. Having initially partnered in 2017 to build Cypfer, where Dubrovsky served as managing partner and chief operating officer, the two executives experienced a severe falling out by 2024, with Dubrovsky alleging that Tobok gradually pushed him out of key business decisions. Tobok denied the allegations, filing a counterclaim accusing Dubrovsky of accessing confidential files and competing unfairly through an alternate entity called CyberSteward Inc.
GHOSTBYTE
Interviews with former colleagues of Daniel Tobok indicate that years prior to these corporate disputes, he was known within specific ransomware circles by the handle "Ghostbyte." In 2018, a Canadian enterprise was compromised by Dharma, a prolific Russian-language ransomware affiliate program. The victim company, finding some locked files entirely unrecoverable, considered paying the ransom but demanded guarantees that the cybercriminals would honor their word.
A redacted email response from the Dharma representative directed the victim toward an external IT professional in Canada capable of providing such security guarantees, explicitly recommending they contact the email address [email protected]. The Dharma operative wrote that the specialized IT firm routinely resolved such extortion scenarios within Canada.
While it remains unclear whether Tobok actively utilized the Ghostbyte address provided by the Dharma affiliate, and despite Tobok not responding to requests for comment, breach tracking services like Constella Intelligence identified that a personal email address frequently used by Tobok—[email protected]—was tied to multiple online accounts utilizing the "ghostbyte" username, including a Snapchat profile. Furthermore, Constella established that the Dharma representative’s crypto wallet address processed tens of millions in equivalent cryptocurrency transactions during that period.
In formal statements addressing the controversy, Cypfer maintained that its business model does not involve facilitating or making ransomware payments, noting that the firm only learned of Dubrovsky’s arrest through media reports. Cypfer emphasized that it had received no outreach from law enforcement and was not the target of any active investigation. The statement clarified that Cypfer and CyberSteward operate as completely separate entities with no shared leadership, and highlighted Cypfer’s recent acquisition by the Apros Group, a holding company led by former FBI special agent Jason Hogg.
CONFLICTING INTERESTS
Under United States law, paying a ransom to obtain an encryption key or secure a promise of data deletion is not inherently illegal, provided the targeted cybercrime group has not been officially designated as a sanctioned entity by the U.S. Treasury Department. ShinyHunters currently holds no such official sanctions. However, the ecosystem surrounding cyber incident response and extortion negotiation is fraught with systemic conflicts of interest.
Insurance providers frequently direct corporate victims toward specialized incident response firms. While many forensic companies refuse to facilitate extortion payments on ethical grounds, others step in to fill the void, creating an environment where payment facilitators benefit directly from the scale of the crisis. Leading incident response organizations, such as Coveware and Unit 221B, have consistently warned victims that paying ShinyHunters is futile, pointing out that extortionists routinely retain, resell, or weaponize stolen data regardless of financial settlements.
The FBI reinforced these warnings in official public advisories cautioning against paying the ShinyHunters group. Internal chat logs recovered from ShinyHunters’ Telegram channels revealed deep frustration among the group’s leadership over Coveware’s public stance, with core operators complaining that Coveware’s expert guidance was severely damaging their enterprise revenue and actively preventing victims from paying.
Industry experts have long pointed out the inherent conflicts plaguing ransom negotiation models. Mark Camillo, chief executive of CyberAcuView, noted that while some firms charge flat retainers, others take a direct percentage of the total ransom paid. This financial structure provides an active incentive for negotiators to maximize payouts rather than drive down costs.
Recent federal prosecutions underscore these systemic vulnerabilities. The U.S. Department of Justice charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy for allegedly billing customers for ransomware remediation while secretly paying hackers behind their clients’ backs. Similarly, a Florida-based ransomware negotiator, Angelo Martino, was sentenced to prison for conspiring with the BlackCat/ALPHV ransomware syndicate to provide confidential victim negotiation strategies, enabling attackers to maximize extracted ransoms.
