The revelations come as the FBI moves with unusual speed and urgency following a series of aggressive breaches orchestrated by hackers aligned with the ShinyHunters brand. Since 2019, the collective has claimed credit for dozens of major corporate and institutional data breaches. While the group was initially operated primarily by cybercriminals residing in France, those original members were systematically arrested or jailed, allowing control of the ShinyHunters moniker to transition to “Rey,” a teenage hacker based in Amman, Jordan, who was identified by authorities last year. According to FBI estimates, the syndicate has successfully extorted more than $70 million from victims globally this year alone.
The investigation intensified dramatically in late September when ShinyHunters compromised the FBI recruitment portal, fbijobs.gov, taunting federal law enforcement by threatening to publish sensitive internal files. The leaked material reportedly included personal employee data such as medical and psychological records, Social Security numbers, home addresses, and details regarding specialized internal units.
The brazen breach of its own infrastructure prompted the bureau to cast a wide net, detaining and questioning individuals who had maintained communications with Rey and other suspects. On October 3, Reuters reported that Rey had been detained by authorities in Jordan and was actively cooperating with the FBI.
Rey’s ascendance to administrative control over the hacking group followed the sudden incapacitation of one of its alleged senior members. On the evening of September 15, 2026, law enforcement officers in the Netherlands executed a tactical raid, deploying flash-bang grenades to stun and apprehend convicted hacker and ShinyHunters suspect Pepijn van der Stap while he was actively logged into various online accounts.
According to sources close to the inquiry, Dutch police caught Van der Stap while he was using his Signal instant messaging account. This tactical breakthrough granted investigators immediate access to recent communications with frequent contacts, including ransomware negotiators operating out of Canada and the United States.
Multiple sources with direct knowledge of the matter told KrebsOnSecurity that Van der Stap’s decrypted Signal messages served as the pivotal clue in unraveling a chilling murder-for-hire plot that surfaced immediately following his arrest. Dutch news outlet RTL reported last month that two murders were allegedly planned to be carried out abroad, with investigative indications pointing to Van der Stap as the individual who issued the orders, though law enforcement found no evidence that the plots were ever executed.
Further analysis of Van der Stap’s messaging logs yielded even more explosive discoveries. On October 9, KrebsOnSecurity broke the news that the FBI had arrested a 54-year-old Canadian cybersecurity executive named Edward Dubrovsky in connection with the ongoing ShinyHunters investigation. Dubrovsky, who recently published a book on handling cyber extortion that advised always engaging with threat actors, was formally charged with threatening to disclose hacked data and interfering with interstate commerce through extortion, according to federal court records. Politico reported that prosecutors requested Dubrovsky be held in custody pending trial, and court records related to the case remain sealed under protective orders.
Investigators reviewing Van der Stap’s chat archives discovered that Dubrovsky maintained frequent, direct lines of communication with the Dutch hacker. Crucially, the logs revealed that Dubrovsky and at least one executive at a large U.S.-based consulting firm were routinely informed of new ShinyHunters victims well before the targeted organizations themselves discovered they had been breached. Furthermore, investigators found that Dubrovsky was aware that ShinyHunters had exfiltrated highly sensitive personnel data from FBI servers long before the group publicly threatened on Twitter/X to release the deep-seated records.
SHINYWIRE
Federal investigators believe that at least one executive at a prominent U.S.-based consulting firm played a direct, active role in operating the now-defunct ShinyHunters victim extortion portal known as shinywire[.]com. While KrebsOnSecurity is withholding the name of the U.S. company and the suspected executive pending formal criminal charges, the firm in question is an established entity with more than 1,000 professional associates.
The Shinywire domain was active from approximately May 3 until October 16, hosting listings for nearly 100 organizations compromised by ShinyHunters. Each entry functioned as a direct pressure tactic, urging corporate victims to initiate contact with the cybercrime syndicate to negotiate payment terms. The pages featured samples of stolen proprietary files, accompanied by the explicit warning that the entire cache would be publicly leaked if demands were ignored.
Archived records from scanning services such as urlscan.io highlight specific extortion pages hosted on the site, including a demand targeting Intuitive Surgical, an American medical technology company breached in March after an employee fell victim to a targeted phishing campaign that compromised corporate credentials.
Under the mechanics of the scheme, victim organizations that refused to engage or negotiate within a strict seven-day window found their stolen data permanently published on the main ShinyHunters shaming blog, a site exclusively accessible via the Tor anonymity network.
The legal fallout has also exposed bitter internal fractures within the cybersecurity industry. In a report published on October 15, The Globe and Mail detailed that months prior to his arrest, Edward Dubrovsky had filed a civil lawsuit in Ontario against Daniel Tobok, the former chief executive of Cypfer, a Toronto-founded cybersecurity firm with international offices spanning the United States, Britain, the Netherlands, the United Arab Emirates, and Mexico.
Dubrovsky and Tobok initially became business partners in 2017, building Cypfer together where Dubrovsky served as managing partner and chief operating officer. However, by 2024, their professional relationship deteriorated significantly. Dubrovsky alleged in court documents that Tobok systematically pushed him out of business operations and made increasingly erratic management decisions. Tobok denied the allegations, filing a counterclaim accusing Dubrovsky of accessing confidential information, unfairly competing through a separate entity called CyberSteward Inc., and misrepresenting his status as a firm founder and non-shareholder.
GHOSTBYTE
Interviews with several former colleagues of Daniel Tobok indicate that as far back as eight years ago, the executive was known within certain ransomware circles by a specific moniker: Ghostbyte. In 2018, a Canadian enterprise fell victim to an intrusion by Dharma, a prolific Russian-language ransomware affiliate program that emerged in 2016. When the victim company expressed willingness to pay to recover unrecoverable encrypted files but demanded assurances that the hackers would honor their word, the Dharma representative pointed them toward an intermediary.
A redacted copy of the extortionist’s reply advised the victim to contact a specific individual at a Canadian IT firm specializing in such matters, directing them to the email address [email protected].
"If you want guarantees, you can write to the IT company," the Dharma operative wrote. "Take the phone and negotiate with them. This IT company often solves such problems in Canada. You can contact them and sign a contract for services. You’ll still have to pay."
While it remains unclear whether Tobok actively utilized the Ghostbyte address provided by the Dharma affiliate, and Tobok has not responded to multiple requests for comment, breach tracking data from Constella Intelligence reveals a notable digital footprint. An email address frequently utilized by Tobok, [email protected], is associated with two online accounts—including a Snapchat profile—that utilized the username "ghostbyte."
Additionally, Constella’s threat intelligence mapping links the Dharma representative’s email address, [email protected], to a cryptocurrency wallet address that processed 38 transactions totaling approximately 43 bitcoin, valued at roughly $3.5 million at current exchange rates, with its most recent recorded transaction dating to February 2019.
In a public statement issued on October 14, Cypfer maintained that its business operations do not involve facilitating ransomware payments and stated that leadership first learned of Dubrovsky’s arrest through media reports.
"We had no prior knowledge of Mr. Dubrovsky’s arrest," a Cypfer spokesperson said via email. "CYPFER has not received any outreach from law enforcement and, to our knowledge, is not the target of any law enforcement investigation."
The company’s statement emphasized that CyberSteward and Cypfer operate as entirely separate corporate entities with no officers, directors, or employees in common. Cypfer was recently acquired by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. In 2020, Aon acquired Cytelligence, a security consulting firm where Tobok served as founder and CEO and Dubrovsky operated as managing partner.
CONFLICTING INTERESTS
Under United States law, paying a ransom to obtain an encryption key or secure a promise to delete stolen data is not inherently illegal, provided the victim organization does not run afoul of federal sanctions administered by the U.S. Treasury Department’s Office of Foreign Assets Control. Because ShinyHunters is not currently designated on official sanctions lists, payments to the group do not automatically trigger criminal liability under sanctions laws, though they frequently attract intense regulatory and law enforcement scrutiny.
Industry experts note that ransomware victims are routinely directed by cyber insurance carriers to engage specific incident response firms. However, not all digital forensics providers are willing to broker extortion payments. When a specialized firm refuses to reward criminals, corporate clients frequently replace them with firms unhindered by such ethical boundaries.
This dynamic came to the forefront in December 2024, when ShinyHunters targeted educational technology firm PowerSchool, exfiltrating private records belonging to 62 million students and 9.5 million teachers across the United States and Canada. PowerSchool reportedly paid a $2.85 million ransom. Documentation regarding the incident indicates the company was assisted in the negotiation process by CyberSteward. A 20-year-old ShinyHunters affiliate from Massachusetts, Matthew Lane, was subsequently sentenced in November 2025 to four years in prison for his role in the hack.
Despite the multi-million-dollar payment, the remediation failed to prevent subsequent extortion attempts using the identical stolen dataset. By May 2025, individual school districts across North America reported receiving secondary extortion demands containing samples of the same files stolen from PowerSchool. While authorities have not alleged that ShinyHunters directly orchestrated the secondary extortion wave, the incident highlights a fundamental reality of modern cybercrime: victims have no technical guarantee that threat actors have actually deleted stolen data, nor can they prevent rogue actors from exploiting compromised records indefinitely.
Several leading incident response firms, including Coveware and Unit 221B, have consistently advised victims against paying ransoms to ShinyHunters, publicly noting that so-called "destroyed" data is frequently retained, resold, or leveraged to directly target downstream clients.
The FBI reinforced this stance in a formal advisory issued on May 15, explicitly cautioning organizations against yielding to ShinyHunters’ demands. Consequently, leaders of the cybercrime syndicate have frequently targeted Coveware and Unit 221B with online harassment and threats in retaliation for their public guidance.
Internal communications reviewed by investigators underscore the hackers’ frustration with security firms advising clients not to pay. In private Telegram chats from April and May 2026, the main ShinyHunters account complained to co-conspirators that Coveware was actively damaging their bottom line by convincing victims to withhold payment. In one message, the operator lamented, "Go on my website, majority of those companies would’ve paid if it weren’t for Coveware giving them misinformation," adding that they were actively seeking to "eliminate the problem."
Mark Camillo, chief executive of CyberAcuView—an industry consortium established in 2021 by major cyber insurance providers—pointed out that financial structures within the remediation sector often create an inherent conflict of interest. While some incident response firms operate on a flat retainer fee, those specializing in ransom negotiations frequently charge a percentage of the total payout.
"It has come to the industry’s attention that many of the ransomware payers charge a percentage of the final payment which may or may not be disclosed," Camillo said. "This makes no sense if they are also the negotiator. There needs to be more transparency in the process as no one in the ecosystem should be profiting purely on the size of the ransomware transaction or payment itself."
Camillo noted that while negotiation firms argue percentage-based fees offset the operational risks of sourcing large quantities of cryptocurrency and absorbing market volatility, greater visibility and regulatory clarity are necessary to eliminate misaligned incentives.
Recent enforcement actions by the U.S. Department of Justice highlight the growing judicial crackdown on corrupt intermediaries. On October 7, federal prosecutors charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy for allegedly billing customers for ransomware remediation while secretly paying hackers behind the scenes, disbursing $8 million to cybercriminals while invoicing clients $19 million.
Earlier in July, Angelo Martino, a ransomware negotiator based in Florida, was sentenced to 70 months in prison for conspiring with the Blackcat/ALPHV ransomware collective to extort multiple corporate victims by leaking confidential negotiation strategies to maximize ransom payouts.
