U.S. federal investigators pursuing the prolific ShinyHunters hacking group—which recently compromised sensitive data belonging to the Federal Bureau of Investigation—have identified executives at two separate ransomware negotiation firms who maintained unusually close relationships with the cyber extortionists. Sources close to the active investigation have disclosed that one of these executives in the United States allegedly went so far as to help ShinyHunters operate a dedicated pressure website designed to coerce victims into paying ransoms.
Hackers aligned with the ShinyHunters banner have claimed responsibility for dozens of major corporate and institutional data breaches since 2019. During its initial years, the syndicate was primarily operated by cybercriminals operating out of France. As those founding members were systematically arrested and jailed by international law enforcement, control over the ShinyHunters brand eventually transitioned to an individual known online as “Rey.” Last year, authorities identified Rey as a teenage hacker residing in Amman, Jordan. According to official FBI estimates, the ShinyHunters network has successfully extorted more than $70 million from victims globally this year alone.
The group’s brazen operations reached a critical turning point in late September when ShinyHunters successfully breached the FBI recruitment portal, fbijobs.gov. The hackers taunted the federal law enforcement agency by threatening to publish deeply sensitive stolen files. Reports indicate the compromised information included medical and psychological records, Social Security numbers, home addresses, and detailed records regarding individual employees’ specialized units and assignments.
This high-profile breach of an internal federal recruitment site prompted the FBI to move with extraordinary speed to identify, detain, and question individuals who maintained any communications with Rey or other key ShinyHunters suspects. On October 3, Reuters reported that Rey had been detained by Jordanian authorities and was actively cooperating with federal investigators.
Rey’s consolidation of power within the hacking collective occurred because a vital senior member of the group had just been captured. On the evening of September 15, law enforcement officers in the Netherlands executed a tactical raid, arresting convicted hacker and primary ShinyHunters suspect Pepijn van der Stap. Dutch police reportedly deployed flash-bang grenades to stun and apprehend Van der Stap while he was actively logged into various online accounts.
According to a source close to the ongoing investigation, authorities successfully seized control of Van der Stap while he was utilizing his Signal instant messaging application. This immediate physical access allowed investigators to review recent communications with frequent contacts, including ransomware negotiators based in Canada and the United States.
Multiple sources with direct knowledge of the matter informed KrebsOnSecurity that Van der Stap’s decrypted Signal messages proved critical in unraveling a separate murder-for-hire plot that surfaced immediately in the wake of his arrest. Dutch news outlet RTL reported last month that two murders were allegedly planned to be carried out abroad, with indications pointing to Van der Stap as the individual who issued the orders, though law enforcement found no evidence that the plots were ever successfully executed.
On October 9, KrebsOnSecurity broke the news that the FBI had arrested a 54-year-old Canadian cybersecurity executive named Edward Dubrovsky in connection with the broadening ShinyHunters investigation. Dubrovsky, who recently published a book on handling cyber extortion that explicitly recommended always engaging with hackers, was formally charged in U.S. federal court with threatening to disclose hacked data and interfering with interstate commerce through extortion, according to court documents filed on the docket. Politico reported that federal prosecutors requested Dubrovsky be held in custody pending trial and that records associated with his case remain sealed.
A source close to the investigation revealed that Van der Stap’s recovered Signal logs demonstrated frequent, direct conversations between the Dutch hacker, Dubrovsky, and at least one executive at a prominent U.S.-based consulting firm. Investigators noted that these executives frequently possessed detailed information regarding newly breached ShinyHunters victims before the victim organizations themselves were even aware they had been compromised.
Furthermore, investigators uncovered what sources described as a potentially explosive finding: the Dutch hacker’s chats indicated that Dubrovsky was fully aware that ShinyHunters had exfiltrated highly sensitive personnel files from FBI servers, yet he never notified the bureau prior to the syndicate publicly threatening on social media to release the deeply personal documents.
SHINYWIRE
Federal investigators probing the ShinyHunters network have concluded that at least one executive at a U.S.-based consulting firm played an active operational role in running the now-defunct victim extortion portal known as "shinywire[.]com." While KrebsOnSecurity has learned details of this involvement from two independent sources close to the probe, the U.S. firm and the suspected executives are not being publicly named at this time because formal criminal charges have not yet been filed. The entity in question is described as a prestigious consulting firm employing more than 1,000 associates.
The Shinywire portal remained active from approximately May 3 until October 16, featuring listings for nearly 100 organizations that had fallen victim to ShinyHunters intrusions. Each entry on the site pressured victim companies to open lines of communication with the cybercrime syndicate to negotiate ransom payments. The pages routinely displayed samples of stolen corporate files, accompanied by explicit warnings that the entire cache would be permanently published online if the victim failed to meet financial demands within a strict deadline.
Cached records from scanning services such as urlscan.io cataloged numerous extortion entries, including one targeting Intuitive Surgical, an American medical technology company that suffered a breach in March after an employee fell victim to a targeted phishing email attack. Under the mechanics of the site, victim organizations that refused to engage or negotiate within a seven-day window found their stolen data permanently published on the main ShinyHunters victim-shaming blog, which is hosted exclusively on the anonymous Tor network.
In a report published on October 15, The Globe and Mail detailed that months prior to his arrest by the FBI, Edward Dubrovsky had alleged in Canadian court documents that he had become collateral damage in a malicious campaign orchestrated by a former business partner seeking to destroy another industry executive. Dubrovsky had filed a civil lawsuit in Ontario earlier in the year against Daniel Tobok, the former chief executive of Cypfer, a prominent cybersecurity firm founded in Toronto with international offices spanning the United States, Britain, the Netherlands, the United Arab Emirates, and Mexico.
The two men originally became business partners in 2017 and subsequently built Cypfer together, with Dubrovsky serving as a managing partner and chief operating officer. However, by 2024, their relationship had severely deteriorated. Dubrovsky accused Tobok of gradually freezing him out of core business decisions and exhibiting increasingly erratic management behavior. Tobok countered these claims by filing a lawsuit of his own, accusing Dubrovsky of misappropriating confidential information and engaging in unfair competition through a separate entity known as CyberSteward Inc. Tobok also maintained that Dubrovsky had misrepresented his status as a founder of Cypfer and held no equity shares in the enterprise.
GHOSTBYTE
Interviews with several former colleagues of Daniel Tobok revealed that as far back as eight years ago, he was known among early ransomware purveyors by a specific moniker: Ghostbyte. In 2018, a Canadian corporation fell victim to Dharma, a prolific Russian-language ransomware affiliate program that first emerged in 2016. When the victim company informed the Dharma representative that they were leaning toward paying the ransom because critical encrypted files were unrecoverable, they requested stronger guarantees that the hackers would honor their word upon payment.
A redacted copy of the cybercriminal’s email reply advised the victim to contact an independent IT firm that specialized in providing such assurances, explicitly recommending that they reach out to an email address listed as [email protected]. The Dharma representative wrote that the IT company routinely solved such complications in Canada and instructed the victim to sign a formal service contract with them.
While it remains unconfirmed whether Tobok actively utilized the Ghostbyte address provided by the Dharma affiliate, and he has not responded to multiple requests for comment, threat intelligence data from Constella Intelligence indicates a connection. Constella discovered that an email address frequently used by Tobok—[email protected]—was tied to two online accounts utilizing the exact username "ghostbyte," including a registered Snapchat profile. Furthermore, Constella analysis linked the Dharma representative’s email address, [email protected], to a specific cryptocurrency wallet that processed 38 transactions totaling roughly 43 bitcoin, valued at approximately $3.5 million at contemporary rates, with its most recent transaction dated February 2019.
In an official statement released on October 14, Cypfer maintained that its corporate business model does not involve making or facilitating ransom payments on behalf of clients. The firm asserted that it learned of Dubrovsky’s federal arrest exclusively through breaking media reports.
A company spokesperson stated that Cypfer had no prior knowledge of the arrest, had received no outreach from law enforcement agencies, and was not the target of any ongoing investigation. The statement additionally clarified that CyberSteward and Cypfer operate as entirely separate corporate entities sharing no common officers, directors, or employees. Cypfer was recently acquired by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. In 2020, Aon had previously acquired Cytelligence, a security consultancy where Tobok served as founder and CEO and Dubrovsky operated as managing partner.
CONFLICTING INTERESTS
Under U.S. law, it is not inherently illegal to pay cybercriminals for a decryption key to restore locked systems or to secure a promise to delete stolen data files. However, victim organizations face severe legal liabilities if they disburse funds to criminal collectives that have been formally sanctioned by the U.S. Treasury Department, though ShinyHunters is not currently designated on any government sanctions list.
Industry experts note that cyber insurance providers typically direct breached organizations to specific incident response firms. Yet, not all digital forensics and breach response providers are willing to facilitate extortion payments. When ethical firms decline to reward hackers, clients frequently replace them with firms unconstrained by such policies.
In December 2024, the ShinyHunters network began extorting education technology provider PowerSchool, exfiltrating private data belonging to 62 million students and 9.5 million teachers across the United States and Canada. PowerSchool reportedly paid a $2.85 million ransom. Documentation regarding the incident indicated the company was assisted by CyberSteward. A 20-year-old ShinyHunters affiliate from Massachusetts, Matthew Lane, was subsequently sentenced in November 2025 to four years in prison for his admitted role in the PowerSchool compromise.
Despite the ransom payment, the settlement failed to prevent subsequent extortion attempts using the identical stolen database. By May 2025, individual school districts across North America reported receiving targeted ransom demands featuring samples of the exact same stolen records. While authorities did not accuse ShinyHunters of orchestrating the secondary wave of extortion, the incident underscored a fundamental reality of the cybercrime economy: there is no technical mechanism to ensure malicious actors permanently delete exfiltrated data or to prevent third parties from exploiting compromised records.
Several prominent incident response organizations, including Coveware and Unit 221B, have consistently warned corporate victims against paying ShinyHunters. Investigators emphasize that data allegedly destroyed by extortionists is frequently retained, resold, or leveraged directly against a company’s downstream clients. The FBI echoed these warnings in an official advisory issued on May 15, advising against satisfying the demands of the ShinyHunters syndicate.
Internal communications reviewed by federal investigators revealed that ShinyHunters leadership expressed intense frustration toward Coveware for persistently advising victims not to pay. In private Telegram chats from May and April 2026, the primary ShinyHunters account complained to co-conspirators that Coveware was actively damaging their business model and lowering their successful payout rates. In one message, the group’s operator declared their intent to "eliminate the problem" posed by Coveware’s advisory role. Coveware declined to comment on the threats.
Mark Camillo, chief executive of CyberAcuView—an industry association established in 2021 by a consortium of major cyber insurers—explained that the financial models of certain negotiation firms introduce inherent conflicts of interest. While some consultants charge flat retainer fees, others operate on a contingency model, taking a percentage of the total ransom disbursed. Camillo noted that negotiators charging a percentage have a clear financial incentive to push for higher settlements and discourage aggressive price reduction.
This dynamic has drawn increasing scrutiny from the U.S. Department of Justice, which has ramped up prosecutions against rogue ransomware negotiators accused of defrauding their own corporate clients. On October 7, the DOJ charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy for allegedly billing clients for technical remediation while secretly paying out $8 million in ransoms behind their backs, ultimately billing customers $19 million. Similarly, in July, Florida-based ransomware negotiator Angelo Martino was sentenced to 70 months in federal prison for conspiring with the Blackcat/ALPHV ransomware collective to extort victims by covertly leaking client negotiating strategies to maximize payouts.
