{"id":2110,"date":"2026-10-19T14:51:19","date_gmt":"2026-10-19T14:51:19","guid":{"rendered":"https:\/\/wyominginvest.com\/?p=2110"},"modified":"2026-10-19T14:51:19","modified_gmt":"2026-10-19T14:51:19","slug":"u-s-federal-investigators-eye-ransomware-negotiation-executives-over-close-ties-to-shinyhunters","status":"publish","type":"post","link":"https:\/\/wyominginvest.com\/?p=2110","title":{"rendered":"U.S. Federal Investigators Eye Ransomware Negotiation Executives Over Close Ties to ShinyHunters"},"content":{"rendered":"

U.S. federal investigators pursuing the notorious ShinyHunters hacking group\u2014which recently compromised highly sensitive data belonging to the Federal Bureau of Investigation\u2014have identified executives at two separate ransomware negotiation firms who maintained unusually close and covert relationships with the extortion syndicate. Sources close to the ongoing investigation indicate that one of these U.S.-based executives even assisted ShinyHunters in operating a dedicated pressure website designed to coerce victims into paying ransoms.<\/p>\n

Hackers aligned with the ShinyHunters banner have claimed credit for dozens of major corporate and institutional data breaches since 2019, a period when the collective was primarily operated by cybercriminals residing in France. As those original members were systematically identified, arrested, and jailed by international law enforcement, control over the ShinyHunters brand eventually transitioned to a teenage hacker from Amman, Jordan, known online as "Rey," who was identified by researchers and law enforcement last year. According to FBI estimates, the group has successfully extorted more than $70 million from victims globally this year alone.<\/p>\n

The group’s operations escalated dramatically in late September, when hackers linked to ShinyHunters successfully breached the FBI recruitment website, fbijobs.gov. The attackers brazenly taunted the agency with threats to publish a trove of stolen files, which reportedly included deeply personal details such as medical and psychological records, Social Security numbers, home addresses, and specific information concerning each employee’s unit and professional specialization. <\/p>\n

This high-profile breach of a federal law enforcement portal prompted the FBI to move with uncommon speed, tracking down, detaining, and questioning individuals who had established any prior communications with Rey or other key suspects. Reuters reported on October 3 that Rey had been detained by Jordanian authorities and was actively cooperating with the FBI.<\/p>\n

Rey’s ascent to control the hacking group occurred shortly after the disruption of one of its alleged senior members. On the evening of September 15, law enforcement officers in the Netherlands arrested convicted hacker and primary ShinyHunters suspect Pepijn van der Stap. Dutch police reportedly deployed flash-bang grenades to stun and apprehend Van der Stap while he was actively logged into various online accounts.<\/p>\n

According to a source close to the investigation, authorities intercepted Van der Stap while he was using his Signal instant messaging account, granting them immediate access to recent communications with frequent contacts, including ransomware negotiators operating out of Canada and the United States. <\/p>\n

Multiple sources with direct knowledge of the matter revealed that Van der Stap’s encrypted messages were instrumental in unraveling a separate murder-for-hire plot that surfaced immediately following his arrest. The Dutch news outlet RTL reported last month that two murders were allegedly planned to be carried out abroad, with indications pointing toward Van der Stap as the individual who issued the orders, though investigators found no evidence that the plots were ever executed.<\/p>\n

\"Feds<\/figure>\n

On October 9, KrebsOnSecurity broke the news that the FBI had arrested a 54-year-old Canadian cybersecurity executive named Edward Dubrovsky in connection with the broadening ShinyHunters investigation. Dubrovsky, who recently published a book on handling cyber extortion that explicitly recommended always engaging with malicious actors, was formally charged with threatening to disclose stolen data and interfering with interstate commerce through extortion, according to federal court records. Politico reported that federal prosecutors requested Dubrovsky remain in custody pending trial, and that all records associated with his case remain sealed.<\/p>\n

A source close to the investigation disclosed that Van der Stap\u2019s Signal logs demonstrated frequent, direct conversations between the Dutch hacker, Mr. Dubrovsky, and at least one executive at a prominent U.S.-based consulting firm. These conversations allegedly revealed that the executives often possessed detailed knowledge of new ShinyHunters victims before the targeted organizations themselves had even discovered the security breaches.<\/p>\n

In perhaps the most explosive finding uncovered by federal investigators, the Dutch hacker\u2019s chat records showed that Mr. Dubrovsky was fully aware that ShinyHunters had successfully exfiltrated highly sensitive data from FBI servers. Despite this knowledge, Dubrovsky never alerted the bureau to the security breach prior to ShinyHunters publicly threatening on social media to release the agency\u2019s deeply personal personnel records.<\/p>\n

SHINYWIRE<\/p>\n

Federal investigators probing the ShinyHunters network have concluded that at least one executive at a U.S.-based consulting firm played an active, operational role in managing the now-defunct ShinyHunters victim extortion website, shinywire.com. While the specific company and executive have not yet been named publicly as they have not faced formal criminal charges, sources describe the entity as a prestigious firm boasting more than 1,000 associates.<\/p>\n

The Shinywire portal remained active from approximately May 3 until October 16, cataloging entries for nearly 100 organizations that had fallen victim to ShinyHunters breaches. Each listing prominently urged victimized companies to engage with the cybercrime collective to negotiate payment terms. The pages featured samples of the stolen data alongside explicit warnings that the files would be permanently published online should the targets ignore the extortion demands.<\/p>\n

Victim organizations that refused to open lines of communication or negotiate within a strict seven-day window discovered their stolen records published indiscriminately on the main ShinyHunters victim-shaming blog, which is hosted exclusively on the Tor anonymity network.<\/p>\n

The operational entanglements surrounding these firms have also spilled into civil litigation. In a report published mid-October, The Globe and Mail detailed that months prior to his arrest by the FBI, Edward Dubrovsky had filed a lawsuit in Ontario alleging he had become collateral damage in an aggressive campaign by a former business partner seeking to dismantle another industry executive.<\/p>\n

\"Feds<\/figure>\n

Court filings showed Dubrovsky sued Daniel Tobok, the former chief executive of Cypfer, a Toronto-founded cybersecurity firm with offices spanning the United States, Britain, the Netherlands, the United Arab Emirates, and Mexico. The two men initially partnered in 2017 to build Cypfer, where Dubrovsky served as managing partner and chief operating officer. However, by 2024, their relationship deteriorated, with Dubrovsky alleging that Tobok gradually isolated him from business operations and executed increasingly erratic management decisions. <\/p>\n

Tobok denied the allegations and filed a counterclaim accusing Dubrovsky of misappropriating confidential information and engaging in unfair competition through a separate venture named CyberSteward Inc. Tobok also claimed Dubrovsky had misrepresented his status as a Cypfer founder and lacked equity shares in the enterprise.<\/p>\n

GHOSTBYTE<\/p>\n

Interviews with several former colleagues of Mr. Tobok revealed that as far back as eight years ago, he was known among ransomware purveyors by a specific moniker: Ghostbyte. In 2018, a Canadian company targeted by Dharma\u2014a prolific Russian-language ransomware affiliate program active since 2016\u2014reported that while they leaned toward paying the ransom to recover unrecoverable encrypted files, they required stronger guarantees that the hackers would honor their word.<\/p>\n

According to a redacted copy of the reply sent by the Dharma representative, the ransomware operators instructed the victim to contact a specific IT professional in Canada who specialized in securing such guarantees, directing them to the email address ghostbyte@tutanota.com.<\/p>\n

The Dharma representative wrote in the email that the victim could reach out to the recommended IT company to sign a service contract and negotiate the matter directly. While it remains unclear whether Mr. Tobok actively utilized the Ghostbyte email address provided by the Dharma affiliate, breach intelligence tracking conducted by Constella Intelligence indicates that an email address frequently used by Mr. Tobok\u2014dtobok@me.com\u2014is linked to multiple online accounts utilizing the username ghostbyte, including a Snapchat profile.<\/p>\n

Furthermore, Constella data associates the Dharma representative’s email address with a specific cryptocurrency wallet that processed 38 transactions totaling roughly 43 bitcoin, valued at approximately $3.5 million at current rates, with its most recent transaction dated February 2019.<\/p>\n

In an official statement, Cypfer maintained that the company’s business model does not involve making or facilitating ransomware payments, noting that leadership learned of Dubrovsky\u2019s arrest through media reports. Representatives asserted that Cypfer had received no outreach from law enforcement and was not the target of any ongoing investigation. <\/p>\n

\"Feds<\/figure>\n

The statement added that Cypfer and CyberSteward operate as distinct corporate entities with no overlapping officers, directors, or employees, and highlighted that Cypfer was recently acquired by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. Aon previously acquired Cytelligence in 2020, a security consulting firm where Tobok served as founder and CEO and Dubrovsky served as managing partner.<\/p>\n

CONFLICTING INTERESTS<\/p>\n

Paying ransom to hackers in exchange for decryption keys or guarantees of data deletion is not inherently illegal in the United States, provided the targeted group is not designated as a sanctioned entity by the U.S. Treasury Department. ShinyHunters currently holds no such official sanctions from the U.S. government or international authorities.<\/p>\n

Cybersecurity experts note that organizations struck by ransomware are typically guided by their insurance providers to retain specific incident response firms. However, because not all forensics and breach response companies agree to facilitate extortion payments on behalf of clients, organizations intent on paying often transition away from firms with ethical restrictions toward those willing to execute transactions.<\/p>\n

For instance, when education technology giant PowerSchool suffered a massive breach in December 2024 that compromised personal data belonging to 62 million students and 9.5 million teachers across the U.S. and Canada, the firm ultimately paid a $2.85 million ransom. Documentation indicates PowerSchool was assisted in that effort by CyberSteward, while a 20-year-old ShinyHunters affiliate from Massachusetts was later sentenced to four years in prison for his role in the hack.<\/p>\n

Despite the ransom payment, the resolution failed to stem secondary extortion efforts. By May 2025, individual school districts began receiving separate ransom demands leveraging samples of the exact same stolen records. This highlighted a persistent industry reality: no technical mechanism exists to verify that threat actors have permanently deleted stolen data, nor can a payment prevent malicious actors from exploiting or reselling identical records through secondary channels.<\/p>\n

Leading cyber incident response firms, including Coveware and Unit 221B, have consistently warned victims against paying ShinyHunters, emphasizing that supposedly destroyed data is routinely retained, monetized, or leveraged to directly target downstream clients. <\/p>\n

The FBI reinforced these warnings in a public service announcement issued on May 15, advising organizations against capitulating to ShinyHunters’ demands. In response, members of the cybercrime group frequently targeted Coveware and Unit 221B employees with online harassment and threats.<\/p>\n

\"Feds<\/figure>\n

Internal communications reviewed by investigators underscore the frustration of ShinyHunters leadership over Coveware’s public stance. In private Telegram chats from May and April 2026, the group’s administrators complained that Coveware’s advice was severely damaging their monetization rates, with the lead account explicitly stating that they were actively seeking to "eliminate the problem" posed by the firm’s anti-ransom advocacy.<\/p>\n

Mark Camillo, chief executive of CyberAcuView\u2014an industry group formed in 2021 by major cyber insurers\u2014pointed out an inherent conflict of interest within the negotiation sector. While some firms operate on flat retainer fees, others charge a percentage of the total ransom disbursed. Camillo argued that this contingency model creates a perverse incentive for negotiators to favor attackers and avoid driving down settlement amounts.<\/p>\n

"It has come to the industry\u2019s attention that many of the ransomware payers charge a percentage of the final payment which may or may not be disclosed," Camillo said, emphasizing the need for greater transparency across the ecosystem to eliminate misaligned financial incentives.<\/p>\n

In recent months, the U.S. Department of Justice has intensified its scrutiny of the sector, bringing criminal charges against several ransomware negotiators accused of defrauding their own clients. On October 7, the DOJ charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy for allegedly billing customers for remediation services while secretly paying ransomware groups behind their backs\u2014funneling $8 million to hackers while charging clients $19 million. Similarly, in July, a Florida-based ransomware negotiator was sentenced to 70 months in prison for conspiring with the BlackCat\/ALPHV ransomware syndicate to extort victims by leaking confidential negotiation strategies to maximize payouts.<\/p>\n","protected":false},"excerpt":{"rendered":"

U.S. federal investigators pursuing the notorious ShinyHunters hacking group\u2014which recently compromised highly sensitive data belonging to the Federal Bureau of Investigation\u2014have identified executives at two separate ransomware negotiation firms who maintained unusually close and covert relationships with the extortion syndicate. Sources close to the ongoing investigation indicate that one of these U.S.-based executives even assisted<\/p>\n","protected":false},"author":1,"featured_media":2109,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[142],"tags":[1819,143,146,1818,370,144,1817,1244,337,169,145,1595],"class_list":["post-2110","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-news","tag-close","tag-cybersecurity","tag-defense","tag-executives","tag-federal","tag-hacking","tag-investigators","tag-negotiation","tag-ransomware","tag-shinyhunters","tag-threats","tag-ties"],"_links":{"self":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/2110","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2110"}],"version-history":[{"count":0,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/2110\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/media\/2109"}],"wp:attachment":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2110"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2110"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2110"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}