U.S. federal investigators pursuing the notorious ShinyHunters hacking group—which recently shocked the cybersecurity community by stealing highly sensitive data from the FBI—have identified executives at two different ransomware negotiation firms who maintained unusually close and illicit relations with the extortion syndicate. According to sources close to the unfolding federal investigation, one of these executives inside the United States even went so far as to help ShinyHunters actively operate a pressure website designed to coerce victims into paying multi-million dollar ransoms.
Hackers aligned with the ShinyHunters banner have claimed credit for dozens of major data breaches since 2019. In its early days, the collective was primarily operated by cybercriminals residing in France. However, as those original members were systematically identified, arrested, and jailed one by one, control over the ShinyHunters brand eventually transitioned to a new leader known as “Rey,” who was publicly identified last year as a teenage hacker based in Amman, Jordan. According to estimates from the FBI, ShinyHunters has successfully extorted more than $70 million from corporate and institutional victims so far this year alone.
The group’s operations took an audacious turn in late September, when ShinyHunters successfully breached the FBI recruitment website, fbijobs.gov. The hackers brazenly taunted federal law enforcement by threatening to publish the stolen files online. Reports indicate that the compromised data included sensitive medical and psychological records, Social Security numbers, home addresses, and specific organizational details regarding individual employees’ units and specializations.
The breach of the FBI jobs portal prompted the agency to move with uncommon speed, arresting, detaining, and questioning individuals who had maintained any communication channels with Rey or other primary ShinyHunters suspects. Reuters reported on October 3 that Rey had been detained by authorities in Jordan and was actively cooperating with federal investigators.
Rey had originally been positioned to assume control over the hacking group because one of its alleged senior operational members had just been captured. On the evening of September 15, law enforcement officers in the Netherlands executed a dramatic arrest of convicted hacker and prominent ShinyHunters suspect Pepijn van der Stap. Dutch police reportedly utilized flash-bang grenades to stun and apprehend Van der Stap precisely as he was logged into various online accounts.
According to sources close to the investigation, authorities managed to seize Van der Stap while he was actively using his Signal instant messaging account. This tactical advantage allowed investigators to instantly read recent communications with his most frequent contacts, including ransomware negotiators based in Canada and the United States.
Multiple sources with direct knowledge of the matter told KrebsOnSecurity that Van der Stap’s decrypted Signal messages served as the crucial key to unraveling a disturbing murder-for-hire plot that emerged immediately in the wake of his arrest. The Dutch news outlet RTL reported last month that two murders were allegedly planned to be carried out abroad, with strong indications suggesting that Van der Stap had given the direct order for the attacks, though there is currently no indication that those orders were ever executed.
On October 9, KrebsOnSecurity broke the news that the FBI had arrested a 54-year-old Canadian cybersecurity executive named Edward Dubrovsky in connection with the broader ShinyHunters investigation. Dubrovsky, who had recently published a book on handling cyber extortion that explicitly recommended always engaging and negotiating with threat actors, was formally charged with threatening to disclose stolen data and interfering with interstate commerce through extortion, according to federal court records. Politico reported that prosecutors subsequently asked that Dubrovsky remain in custody pending trial, and that records related to his federal case remain strictly under seal.
A source close to the investigation revealed that Van der Stap’s Signal message logs showed he engaged in frequent, detailed conversations with Mr. Dubrovsky and at least one executive at a large U.S.-based consulting firm. Disturbingly, these messages indicated that these executives often possessed detailed knowledge of new ShinyHunters victims before the victim organizations themselves had even discovered or acknowledged the security breaches.
That same source shared another potentially explosive finding uncovered by federal investigators: the Dutch hacker’s chat logs demonstrated that Mr. Dubrovsky was fully aware that ShinyHunters had exfiltrated highly sensitive data from FBI servers. Despite this knowledge, Dubrovsky never informed the bureau of the breach prior to ShinyHunters publicly threatening on Twitter/X to publish the agency’s deeply personal personnel files.
SHINYWIRE
Investigators delving deeper into the conspiracy learned from two sources close to the ShinyHunters probe that federal authorities believe at least one executive at a prominent U.S.-based consulting firm played an active, hands-on role in operating the now-defunct ShinyHunters victim extortion portal known as “shinywire[.]com.” KrebsOnSecurity has chosen to withhold the specific name of the U.S. company and the suspected executive or executives pending formal criminal charges, noting only that it is a prestigious firm employing more than 1,000 associates.
The Shinywire website was active from approximately May 3, 2026, until October 16, featuring individual listings for nearly 100 organizations that had been compromised by ShinyHunters. Each entry aggressively urged victim companies to engage with the cybercrime syndicate to discuss payment terms. The web pages also displayed samples of stolen corporate files, promising that the complete caches would be leaked publicly if victims ignored the ransom demands.
Cached records of the platform show extortion listings targeting high-profile entities, such as Intuitive Surgical, an American medical technology company breached in March 2026 after an employee fell victim to a targeted phishing campaign. Under the extortion scheme, victim organizations that refused to engage or negotiate within a strict seven-day window found all of their confidential data published on the primary ShinyHunters shaming blog, which is accessible exclusively via the Tor anonymity network.
The legal and professional fallout has begun rippling across international borders. In a story published on October 15, The Globe and Mail reported that months prior to his arrest by the FBI, Edward Dubrovsky had alleged in Canadian court documents that he had become collateral damage in a bitter campaign by a former business partner seeking to "destroy" another industry executive.
The report noted that Dubrovsky filed a lawsuit in Ontario earlier this year against Daniel Tobok, the former chief executive of Cypfer, a cybersecurity firm founded in Toronto with international offices spanning the U.S., Britain, the Netherlands, the United Arab Emirates, and Mexico. The two originally became business partners in 2017 and subsequently built Cypfer together, with Dubrovsky serving as a managing partner and chief operating officer. However, by 2024, the relationship deteriorated significantly, with Dubrovsky accusing Tobok of gradually freezing him out of core business decisions and making increasingly capricious operational choices.
Mr. Tobok reportedly denied those allegations and filed a counterclaim accusing Dubrovsky of accessing confidential information and engaging in unfair competition through separate work at another entity called CyberSteward Inc. Tobok also maintained that Dubrovsky had misrepresented his status as a founding member of Cypfer and held no equity shares in the company.
GHOSTBYTE
According to interviews conducted with several former colleagues of Mr. Tobok, his connections to the ransomware underworld extend back years. As far back as eight years ago, he was reportedly known to ransomware purveyors by a specific moniker: Ghostbyte. In 2018, a Canadian company fell victim to a cyberattack executed by Dharma, a prolific Russian-language ransomware affiliate program that first emerged in 2016. The victim company informed the Dharma representative that they were leaning toward paying the ransom because critical operational files remained locked and unrecoverable, but they demanded stronger guarantees that the cybercriminals would honor their word once paid.
A redacted copy of the Dharma representative’s reply directed the victim to contact an individual at a Canadian IT firm specializing in such matters, specifically recommending the email address [email protected]. The Dharma representative advised the victim to reach out to the IT company directly, noting that they frequently resolved such situations in Canada under formal service contracts.
While it remains unclear whether Mr. Tobok personally utilized the Ghostbyte address provided by the Dharma representative—and despite his failure to respond to multiple requests for comment—data from the breach-tracking service Constella Intelligence reveals a striking digital overlap. Constella discovered that an email address frequently used by Mr. Tobok—[email protected]—is linked to two online user profiles that adopted the exact username "ghostbyte," including an active Snapchat account.
Furthermore, Constella traced the Dharma representative’s email address, [email protected], to a specific cryptocurrency wallet address that processed 38 transactions totaling approximately 43 bitcoins, valued at roughly $3.5 million at contemporary exchange rates, with the most recent transaction recorded in February 2019.
In an official statement released on October 14, Cypfer management asserted that the firm’s core business model does not involve making or facilitating ransomware payments. The company maintained that it only learned of Dubrovsky’s arrest through media reports. A company spokesperson emphasized that Cypfer had received no outreach from law enforcement and was not the target of any ongoing government investigation.
The statement further clarified that CyberSteward and Cypfer operate as entirely separate entities sharing no common officers, directors, or employees. Cypfer was recently acquired by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. In 2020, Aon had acquired Cytelligence, a security consulting firm where Mr. Tobok previously served as founder and CEO, and Mr. Dubrovsky acted as managing partner.
CONFLICTING INTERESTS
Under U.S. law, paying cybercriminals for a decryption key or securing a promise to delete stolen data is not inherently illegal. However, corporate victims face severe legal liabilities if they remit payments to ransomware syndicates designated as sanctioned entities by the U.S. Treasury Department—though ShinyHunters currently holds no such official designation from the U.S. or allied governments.
Industry experts note that ransomware victims are typically directed by cyber insurance providers to engage specialized incident response firms. Yet, not all forensic response companies agree to facilitate ransom payouts on behalf of clients. Consequently, when victim organizations decide to pay, firms that refuse to reward extortionists are often sidelined and replaced by less scrupulous actors.
In December 2024, ShinyHunters began targeting educational technology provider PowerSchool, ultimately exfiltrating private records belonging to 62 million students and 9.5 million teachers across the United States and Canada. PowerSchool reportedly paid a $2.85 million ransom demand. Documentation regarding the incident indicated that PowerSchool received assistance in the matter from CyberSteward, while a 20-year-old ShinyHunters affiliate from Sterling, Massachusetts, named Matthew Lane, was sentenced in November 2025 to four years in prison for his admitted role in the attack.
Despite the multi-million dollar payout, the ransom did not prevent subsequent extortion attempts utilizing the same compromised data. By May 2025, individual school districts began receiving separate ransom demands accompanied by samples of the exact same stolen files. While no direct allegations tied ShinyHunters to the secondary wave of extortion against PowerSchool users, the incident highlighted a harsh reality: there is no technical mechanism to verify whether threat actors have genuinely deleted stolen data as promised, nor can victims prevent third parties from abusing leaked records.
Leading cyber incident response firms, including Coveware and Unit 221B, have consistently warned corporate victims against paying ransoms to ShinyHunters, emphasizing that "destroyed" data is routinely retained, resold, or leveraged to directly target a company’s clients. The FBI reinforced this guidance in an advisory published on May 15, explicitly warning organizations against yielding to ShinyHunters’ demands. In response, members of the cybercrime group have engaged in persistent harassment and threats directed at employees of Coveware and Unit 221B for counseling clients against payment.
Internal communications reviewed by investigators underscore the hackers’ frustration. In a private Telegram conversation on May 6, 2026, the primary ShinyHunters account complained to a co-conspirator that Coveware was severely damaging their monetization rates. Lamenting that the majority of targeted companies would have paid were it not for Coveware’s intervention, the operators expressed open hostility toward the firm, writing in an April 11 chat that they were actively trying to "eliminate the problem." Coveware declined to comment on the developments.
Mark Camillo, chief executive at CyberAcuView—an industry group established in 2021 by major cyber insurance carriers—pointed out that fee structures within the negotiation sector often create an inherent conflict of interest. While some firms operate on a flat retainer, others charge a percentage of the total ransom negotiated and paid. Camillo noted that percentage-based models incentivize negotiators to secure higher payouts and discourage them from successfully reducing ransom demands.
"It has come to the industry’s attention that many of the ransomware payers charge a percentage of the final payment which may or may not be disclosed," Camillo said, emphasizing the need for greater transparency to remove misaligned financial incentives from the ecosystem.
Federal prosecutors have increasingly targeted corrupt negotiation practices. On October 7, the U.S. Department of Justice charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy for allegedly billing clients for remediation services without paying hackers, while secretly funneling $8 million to ransomware groups behind their clients’ backs. Similarly, in July, Florida-based ransomware negotiator Angelo Martino was sentenced to 70 months in prison for conspiring with the Blackcat/ALPHV ransomware syndicate to exploit confidential client negotiation strategies and maximize extortion payouts.
