{"id":2120,"date":"2026-10-19T22:38:26","date_gmt":"2026-10-19T22:38:26","guid":{"rendered":"https:\/\/wyominginvest.com\/?p=2120"},"modified":"2026-10-19T22:38:26","modified_gmt":"2026-10-19T22:38:26","slug":"federal-investigators-uncover-deep-ties-between-ransomware-negotiators-and-the-shinyhunters-hacking-group","status":"publish","type":"post","link":"https:\/\/wyominginvest.com\/?p=2120","title":{"rendered":"Federal Investigators Uncover Deep Ties Between Ransomware Negotiators and the ShinyHunters Hacking Group"},"content":{"rendered":"

U.S. federal investigators probing the notorious ShinyHunters hacking group\u2014which recently compromised sensitive data from the Federal Bureau of Investigation\u2014have identified senior executives at two separate ransomware negotiation firms who allegedly maintained unusually close and illicit relationships with the extortion syndicate. According to sources close to the unfolding federal investigation, one of these executives, based in the United States, even went so far as to help ShinyHunters operate a dedicated pressure website designed to coerce victims into meeting ransom demands.<\/p>\n

Hackers aligned with the ShinyHunters brand have claimed responsibility for dozens of high-profile data breaches dating back to 2019. During its initial years, the collective was primarily operated by cybercriminals residing in France. As those founding members were systematically arrested, prosecuted, and jailed, operational control over the ShinyHunters banner eventually shifted to a young Jordanian hacker known online as "Rey," who was publicly identified by researchers late last year. According to estimates from the FBI, the syndicate has successfully extorted more than $70 million from corporate and institutional victims over the course of the year.<\/p>\n

The group’s brazen operations escalated significantly in late September, when hackers affiliated with ShinyHunters infiltrated the FBI recruitment website, fbijobs.gov. To taunt federal authorities, the cybercriminals threatened to publish a trove of stolen internal files. The pilfered data reportedly included sensitive medical and psychological records, Social Security numbers, home addresses, and detailed information regarding the individual specializations and units of bureau personnel.<\/p>\n

This unprecedented breach of an FBI-affiliated portal prompted the bureau to move with exceptional swiftness, detaining, arresting, and questioning individuals who maintained any digital communications with Rey or other core ShinyHunters suspects. On October 3, Reuters reported that Rey had been captured by authorities in Jordan and was actively cooperating with the FBI.<\/p>\n

Rey\u2019s rise to administrative control over the collective was facilitated by the sudden neutralization of a senior peer. On the evening of September 15, law enforcement officers in the Netherlands executed a high-impact tactical raid, utilizing flash-bang grenades to stun and apprehend Pepijn van der Stap, a convicted hacker and primary ShinyHunters suspect, while he remained actively logged into various online accounts.<\/p>\n

\"Feds<\/figure>\n

According to sources familiar with the investigation, Dutch police arrested Van der Stap while he was actively using his Signal instant messaging application. This tactical timing enabled law enforcement to capture recent communications with frequent contacts, including ransomware negotiators operating out of Canada and the United States. <\/p>\n

Multiple sources with direct knowledge of the matter revealed that Van der Stap\u2019s recovered Signal messages proved instrumental in unraveling a separate murder-for-hire plot that surfaced immediately following his arrest. Dutch news outlet RTL reported last month that two contract killings were allegedly planned to be carried out abroad, with investigative indications suggesting Van der Stap had issued the orders for the attacks, though there is no evidence indicating the plots were ever executed.<\/p>\n

The fallout from the Dutch raid quickly crossed international borders. On October 9, the cybersecurity research community learned that the FBI had arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the broadening ShinyHunters probe. Dubrovsky, who recently authored a published book on handling cyber extortion that advised victims to always engage with threat actors, was formally charged in U.S. federal court with threatening to disclose hacked data and interfering with interstate commerce through extortion. Court records indicate that prosecutors subsequently requested Dubrovsky remain detained pending trial, with related case files kept under seal.<\/p>\n

Investigative sources disclosed that Van der Stap\u2019s decrypted Signal chats documented frequent, ongoing conversations between the Dutch hacker, Dubrovsky, and at least one executive at a prominent U.S.-based consulting firm. These messages reportedly revealed that the executives frequently possessed detailed knowledge regarding fresh ShinyHunters victims even before the targeted organizations themselves had discovered the security breaches.<\/p>\n

Perhaps most explosive among the findings uncovered by federal investigators was evidence indicating that Dubrovsky was fully aware ShinyHunters had successfully exfiltrated highly sensitive data from federal servers. Despite this knowledge, investigators found that Dubrovsky never notified the bureau of the intrusion before the cybercriminals publicly threatened on social media platform X to release deeply personal personnel files.<\/p>\n

SHINYWIRE<\/p>\n

\"Feds<\/figure>\n

As the probe widened, sources close to the investigation informed researchers that federal authorities believe at least one executive at a major U.S.-based consulting firm played an active role in operating the now-defunct ShinyHunters victim extortion portal, known as "shinywire[.]com." While the prestigious firm employs over 1,000 associates, investigators and researchers have withheld the names of the company and the specific executive pending formal criminal charges.<\/p>\n

The Shinywire domain remained active from approximately May 3 until October 16, hosting extortion profiles for nearly 100 organizations compromised by ShinyHunters. Each entry on the portal pressured victims to communicate with the cybercrime syndicate to negotiate payment terms, supplementing the demands with samples of stolen files and explicit warnings that the full data archives would be made public if demands were ignored.<\/p>\n

Archived records show the site targeted entities such as Intuitive Surgical, an American medical technology company breached earlier in the year following a targeted employee phishing campaign. Under the extortion model facilitated by the platform, victim organizations that failed to engage or reach an agreement within seven days faced the immediate publication of their stolen data on the main ShinyHunters shaming blog, which is accessible exclusively via the Tor anonymity network.<\/p>\n

The legal and professional entanglements surrounding the case grew more complex when The Globe and Mail reported that months prior to his arrest, Dubrovsky had filed a civil lawsuit in Ontario alleging he had become collateral damage in a deliberate campaign by a former business partner seeking to ruin another industry leader. <\/p>\n

The lawsuit targeted Daniel Tobok, the former chief executive of Cypfer, an international cybersecurity firm founded in Toronto with offices spanning the United States, Great Britain, the Netherlands, the United Arab Emirates, and Mexico. Dubrovsky and Tobok initially partnered in 2017 to build Cypfer, where Dubrovsky served as managing partner and chief operating officer. However, their relationship deteriorated by 2024, with Dubrovsky accusing Tobok of marginalizing him from corporate affairs and making erratic business decisions. Tobok denied the allegations, filing a counter-claim accusing Dubrovsky of accessing confidential information and competing unfairly through a separate entity, CyberSteward Inc., while falsely portraying himself as a company founder rather than a shareholder.<\/p>\n

GHOSTBYTE<\/p>\n

\"Feds<\/figure>\n

Interviews with former colleagues of Daniel Tobok indicate that as far back as eight years ago, the executive was known within certain ransomware circles by the alias "Ghostbyte." In 2018, a Canadian company targeted by Dharma\u2014a prolific Russian-language ransomware affiliate program operational since 2016\u2014reported that some of their files were unrecoverable and expressed a willingness to pay, provided they received assurances of the hackers’ reliability.<\/p>\n

In a written response recovered from the incident, a Dharma representative directed the victim to an IT professional in Canada who could provide such guarantees, explicitly recommending they contact the email address ghostbyte@tutanota.com. The representative noted in the correspondence that the designated IT company routinely resolved similar extortion challenges within Canada under formal service contracts.<\/p>\n

While it remains unconfirmed whether Tobok personally utilized the Ghostbyte address provided by the Dharma affiliate, a search conducted via breach-tracking service Constella Intelligence revealed that an email address frequently used by Tobok\u2014dtobok@me.com\u2014was linked to online accounts utilizing the "ghostbyte" username, including a Snapchat profile. Furthermore, Constella established that the Dharma representative\u2019s contact address was tied to a cryptocurrency wallet that processed dozens of bitcoin transactions valued in the millions of dollars.<\/p>\n

In a formal statement addressing the controversy, Cypfer maintained that its business model does not involve making or facilitating ransom payments, adding that the firm learned of Dubrovsky\u2019s arrest through media reports. Representatives asserted that Cypfer had received no outreach from law enforcement and was not the target of any ongoing investigation. The statement noted that Cypfer and CyberSteward operate as distinct corporate entities without shared leadership, and highlighted Cypfer’s recent acquisition by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. Aon had previously acquired Cytelligence, a security firm where Tobok served as founder and Dubrovsky as managing partner.<\/p>\n

CONFLICTING INTERESTS<\/p>\n

Under United States law, paying a ransom to obtain an encryption key or secure a promise to delete stolen files is not inherently illegal, provided the targeted cybercriminal group is not subject to U.S. Treasury Department sanctions. Notably, ShinyHunters is not currently designated on official sanctions lists.<\/p>\n

\"Feds<\/figure>\n

Industry experts note that ransomware victims are frequently guided by cyber insurance providers toward specific incident response firms. However, because not all forensic companies are willing to facilitate extortion payments, clients often cycle through advisors until they find firms amenable to negotiations.<\/p>\n

The integrity of these negotiations has faced growing scrutiny from law enforcement and industry leaders alike. In December 2024, ShinyHunters targeted educational technology provider PowerSchool, exfiltrating data belonging to millions of students and teachers across the U.S. and Canada. PowerSchool reportedly paid a $2.85 million ransom with the assistance of CyberSteward, though subsequent unauthorized extortion attempts emerged against individual school districts using the same compromised records.<\/p>\n

Prominent incident response organizations, including Coveware and Unit 221B, have consistently advised victims against paying ShinyHunters, warning that extorted data is frequently retained, resold, or leveraged for secondary attacks. The FBI issued a similar advisory warning victims against meeting the group’s demands. Internal communications recovered by investigators showed that ShinyHunters leaders expressed intense frustration toward Coveware, complaining in private chats that the firm’s anti-extortion advice was severely damaging their payment success rates and discussing efforts to eliminate the perceived obstacle.<\/p>\n

Mark Camillo, chief executive of cyber insurance industry group CyberAcuView, highlighted the financial conflicts inherent in remuneration models where negotiators charge a percentage of the total ransom paid. Camillo noted that such fee structures create a perverse incentive to maximize ransom payouts rather than negotiate reductions, calling for greater transparency across the incident response ecosystem to remove misaligned financial motivations.<\/p>\n

Federal prosecutors have increasingly targeted abusive negotiation practices. In October, the Department of Justice charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy for allegedly billing customers for ransomware remediation without paying hackers, while secretly paying threat actors millions behind their clients’ backs. Similarly, in July, Florida-based ransomware negotiator Angelo Martino was sentenced to prison for conspiring with the BlackCat\/ALPHV syndicate to extract confidential client negotiation strategies and maximize victim payouts.<\/p>\n","protected":false},"excerpt":{"rendered":"

U.S. federal investigators probing the notorious ShinyHunters hacking group\u2014which recently compromised sensitive data from the Federal Bureau of Investigation\u2014have identified senior executives at two separate ransomware negotiation firms who allegedly maintained unusually close and illicit relationships with the extortion syndicate. According to sources close to the unfolding federal investigation, one of these executives, based in<\/p>\n","protected":false},"author":6,"featured_media":2119,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[198],"tags":[1830,146,370,176,144,1817,1831,184,337,205,169,204,1595,1829],"class_list":["post-2120","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-phishing-social-engineering","tag-deep","tag-defense","tag-federal","tag-group","tag-hacking","tag-investigators","tag-negotiators","tag-phishing","tag-ransomware","tag-security-awareness","tag-shinyhunters","tag-social-engineering","tag-ties","tag-uncover"],"_links":{"self":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/2120","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2120"}],"version-history":[{"count":0,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/2120\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/media\/2119"}],"wp:attachment":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2120"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2120"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2120"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}