{"id":2222,"date":"2026-10-20T22:38:21","date_gmt":"2026-10-20T22:38:21","guid":{"rendered":"https:\/\/wyominginvest.com\/?p=2222"},"modified":"2026-10-20T22:38:21","modified_gmt":"2026-10-20T22:38:21","slug":"federal-investigators-uncover-deep-ties-between-ransomware-negotiators-and-the-shinyhunters-hacking-syndicate-2","status":"publish","type":"post","link":"https:\/\/wyominginvest.com\/?p=2222","title":{"rendered":"Federal Investigators Uncover Deep Ties Between Ransomware Negotiators and the ShinyHunters Hacking Syndicate"},"content":{"rendered":"

U.S. federal investigators pursuing the prolific ShinyHunters hacking group\u2014which recently compromised highly sensitive data belonging to the Federal Bureau of Investigation\u2014have identified senior executives at two distinct ransomware negotiation firms who maintained unusually close and illicit relationships with the extortion syndicate. Sources close to the ongoing investigation revealed that at least one of these U.S.-based executives actively assisted ShinyHunters in operating a dedicated pressure website designed to coerce victims into meeting ransom demands.<\/p>\n

Hackers aligned with the ShinyHunters banner have claimed responsibility for dozens of major corporate and institutional data breaches since 2019. During its initial years, the group was primarily operated by cybercriminals residing in France. However, as those founding members were systematically apprehended, prosecuted, and jailed, operational control over the ShinyHunters brand eventually shifted to a teenage hacker from Amman, Jordan, known online as \u201cRey,\u201d who was unmasked by researchers late last year. According to FBI estimates, the syndicate has successfully extorted more than $70 million from corporate and public-sector victims so far this year.<\/p>\n

The group\u2019s brazen activities escalated dramatically in late September, when hackers tied to ShinyHunters breached the official FBI recruitment portal, fbijobs.gov. The attackers taunted federal authorities by threatening to publicize a cache of stolen internal files. Reports indicate the compromised material included deeply sensitive personnel information, such as medical and psychological records, Social Security numbers, home addresses, and specific details regarding the unit specializations of individual employees.<\/p>\n

This unprecedented breach of a federal law enforcement recruitment site prompted the bureau to move with exceptional speed, arresting, detaining, and interrogating individuals who maintained any form of communication with Rey or other identified ShinyHunters suspects. On October 3, Reuters reported that Rey had been detained by authorities in Jordan and was actively cooperating with the FBI.<\/p>\n

Rey\u2019s elevation to the head of the hacking group followed closely on the heels of another major law enforcement disruption. On the evening of September 15, Dutch authorities executed a dramatic raid, arresting convicted hacker and primary ShinyHunters suspect Pepijn van der Stap. Police reportedly deployed flash-bang grenades to stun and apprehend Van der Stap while he was actively logged into various online accounts.<\/p>\n

\"Feds<\/figure>\n

According to sources close to the investigation, Dutch police intercepted Van der Stap while he was using his Signal instant messaging application. This tactical timing granted investigators real-time access to recent communications with frequent contacts, including ransomware negotiators operating out of Canada and the United States. <\/p>\n

Multiple sources with direct knowledge of the matter indicated that Van der Stap\u2019s decrypted Signal messages became the linchpin in unraveling an alarming murder-for-hire plot that surfaced immediately following his arrest. Dutch media outlet RTL reported last month that two planned murders were allegedly scheduled to be executed abroad, with investigators finding strong indications that Van der Stap issued the orders for the attacks, though there is no evidence to suggest the plots were ever carried out.<\/p>\n

The digital trail soon led to formal criminal charges. On October 9, KrebsOnSecurity broke the news that the FBI had arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the broadening ShinyHunters investigation. Dubrovsky, who recently authored a book on cyber extortion handling that explicitly advised companies to always engage with hackers, was charged with threatening to disclose stolen data and interfering with interstate commerce through extortion, according to federal court records. Politico reported that prosecutors requested Dubrovsky be held in custody pending trial, and that all case-related records remain under seal.<\/p>\n

Investigators analyzing Van der Stap\u2019s Signal archive discovered that the Dutch suspect maintained frequent conversations with Dubrovsky and at least one executive at a major U.S.-based consulting firm. Remarkably, these communications revealed that the executives often possessed detailed knowledge of newly breached ShinyHunters victims before the target organizations themselves were even aware they had been compromised.<\/p>\n

Furthermore, federal investigators uncovered an explosive detail: Van der Stap\u2019s chats showed that Dubrovsky was fully aware that ShinyHunters had successfully looted sensitive data from FBI servers. Despite this knowledge, Dubrovsky never alerted the bureau prior to the syndicate publicly threatening on social media to release the agency’s deeply personal personnel files.<\/p>\n

SHINYWIRE<\/p>\n

\"Feds<\/figure>\n

As the probe widened, investigators unearthed evidence concerning a web infrastructure utilized by the extortionists. Sources close to the ShinyHunters probe revealed that the FBI believes at least one executive at a prominent U.S.-based consulting firm played an active role in operating the now-defunct ShinyHunters victim extortion website known as shinywire.com. While federal authorities have not yet filed formal criminal charges against the executive or the firm\u2014an esteemed organization with more than 1,000 associates\u2014their identities are being closely guarded by investigators.<\/p>\n

The Shinywire portal remained active from approximately May 3 until October 16, featuring listings for nearly 100 corporate and institutional organizations compromised by ShinyHunters. Each entry functioned as an aggressive coercion tool, urging victim entities to open negotiations and discuss payment terms. The web pages featured samples of the stolen files alongside explicit warnings that the full data caches would be leaked publicly if demands were ignored.<\/p>\n

Cached records from monitoring services like urlscan.io highlighted extortion listings targeting prominent entities, such as Intuitive Surgical, an American medical technology firm breached in March after an employee fell victim to a targeted phishing email. Under the operational model utilized by the group, victim organizations that refused to engage or negotiate within a strict seven-day window found their stolen data permanently published on the syndicate’s primary shaming blog, which was hosted exclusively on the Tor anonymity network.<\/p>\n

The fallout from the investigation has also exposed deep corporate rifts and past business disputes. In mid-October, The Globe and Mail reported that months prior to his arrest, Edward Dubrovsky had filed a lawsuit in Ontario alleging he had become collateral damage in a deliberate campaign by a former business partner seeking to ruin another industry executive. <\/p>\n

Court documents revealed Dubrovsky filed the action against Daniel Tobok, the former chief executive of Cypfer, a Toronto-founded cybersecurity firm with international offices spanning the United States, Britain, the Netherlands, the United Arab Emirates, and Mexico. Having formed a business partnership in 2017 to build Cypfer\u2014where Dubrovsky served as managing partner and chief operating officer\u2014the two men experienced a bitter falling out by 2024. Dubrovsky accused Tobok of gradually freezing him out of core business decisions and exhibiting increasingly erratic behavior. Tobok denied the allegations, filing a counterclaim accusing Dubrovsky of misappropriating confidential information, unfairly competing through a separate venture named CyberSteward Inc., and misrepresenting his status as a firm founder.<\/p>\n

GHOSTBYTE<\/p>\n

\"Feds<\/figure>\n

Interviews with several former colleagues of Daniel Tobok revealed that as far back as eight years ago, he was known among ransomware purveyors by a specific moniker: Ghostbyte. In 2018, a Canadian company targeted by Dharma\u2014a prolific Russian-language ransomware affiliate program active since 2016\u2014found itself unable to recover locked files and debated paying a ransom, provided they could secure a reliable guarantee of compliance from the hackers.<\/p>\n

A redacted copy of the Dharma representative\u2019s reply directed the victim to an IT professional in Canada who could provide such assurances, specifically recommending they contact the email address ghostbyte@tutanota.com. The cybercriminals advised the victim that local IT firms frequently mediated such problems in Canada and that entering into a service contract would facilitate the transaction.<\/p>\n

While it remains unclear whether Tobok personally utilized the Ghostbyte address provided by the Dharma representative, digital intelligence mapping paints a compelling picture. Constella Intelligence discovered that an email address frequently used by Tobok, dtobok@me.com, was associated with multiple online accounts utilizing the username "ghostbyte," including a Snapchat profile. Furthermore, Constella linked the Dharma representative’s email address to a cryptocurrency wallet that processed dozens of Bitcoin transactions valued at approximately $3.5 million at contemporary rates.<\/p>\n

Cypfer issued a formal statement maintaining that its corporate operations do not encompass making or facilitating ransomware payments, and asserted that the company learned of Dubrovsky\u2019s arrest through media reports. Representatives emphasized that Cypfer had received no outreach from law enforcement and was not the target of any ongoing investigation. The statement further clarified that CyberSteward and Cypfer operate as entirely separate corporate entities with no shared officers, directors, or employees, noting that Cypfer was recently acquired by the Apros Group, a holding company led by former FBI special agent and former Aon Cyber Solutions Group CEO Jason Hogg. In 2020, Aon had previously acquired Cytelligence, a security firm where Tobok served as founder and Dubrovsky as managing partner.<\/p>\n

CONFLICTING INTERESTS<\/p>\n

Under U.S. law, paying hackers for an encryption key or negotiating the deletion of stolen files is not inherently illegal, provided the ransomware group is not listed under economic sanctions imposed by the U.S. Treasury Department. ShinyHunters currently holds no such designation from Washington or international governments.<\/p>\n

\"Feds<\/figure>\n

Typically, victimized companies rely on cyber insurance providers to direct them toward specialized incident response firms. However, a profound philosophical and operational divide exists within the industry. While numerous forensic firms refuse to facilitate payments to criminal extortionists, companies that willingly mediate transactions often step in once a client decides to pay.<\/p>\n

This dynamic came to the forefront during the massive December 2024 extortion campaign against educational technology provider PowerSchool, which saw the private data of 62 million students and 9.5 million teachers across the U.S. and Canada stolen by ShinyHunters. PowerSchool reportedly paid a $2.85 million ransom with the assistance of CyberSteward\u2014an incident that later resulted in a four-year prison sentence for 20-year-old ShinyHunters affiliate Matthew Lane. <\/p>\n

Despite the payment, the security promise proved illusory. By May, individual school districts began receiving independent ransom demands utilizing samples of the exact same stolen files. Security experts have long warned that paying ransom offers zero technical guarantee that threat actors have permanently deleted pilfered records, nor does it prevent secondary exploitation by third parties.<\/p>\n

Leading incident response firms, including Coveware and Unit 221B, have consistently cautioned victims against paying ShinyHunters, pointing out that stolen data is frequently retained, resold, or weaponized to target clients directly. These warnings drew intense ire from the syndicate. Leaked Telegram conversations from April and May revealed the primary ShinyHunters account complaining bitterly that Coveware’s public guidance was severely undermining their success rate and actively preventing victims from paying. In private chats, the syndicate operator went so far as to discuss ways to "eliminate the problem" posed by Coveware’s advisory stance.<\/p>\n

Industry leaders argue that financial structures within the negotiation ecosystem create unavoidable conflicts of interest. Mark Camillo, chief executive of CyberAcuView\u2014an industry group established in 2021 by major cyber insurers\u2014noted that while some firms operate on flat retainers, others charge contingency fees calculated as a percentage of the total ransom paid. Camillo warned that tying a negotiator’s compensation directly to the final payout creates a perverse incentive to inflate ransom amounts rather than negotiate them down, calling for greater transparency across the insurance and remediation ecosystem.<\/p>\n

Federal prosecutors have increasingly targeted abusive practices within the negotiation sector. On October 7, the Department of Justice charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy, alleging he charged clients millions for remediation while secretly paying hackers a fraction of the cost. Similarly, in July, Florida-based ransomware negotiator Angelo Martino was sentenced to 70 months in prison for conspiring with the Blackcat\/ALPHV ransomware group to leak confidential client negotiation strategies and maximize extortion payouts.<\/p>\n","protected":false},"excerpt":{"rendered":"

U.S. federal investigators pursuing the prolific ShinyHunters hacking group\u2014which recently compromised highly sensitive data belonging to the Federal Bureau of Investigation\u2014have identified senior executives at two distinct ransomware negotiation firms who maintained unusually close and illicit relationships with the extortion syndicate. Sources close to the ongoing investigation revealed that at least one of these U.S.-based<\/p>\n","protected":false},"author":16,"featured_media":2221,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[198],"tags":[1830,146,370,144,1817,1831,184,337,205,169,204,1283,1595,1829],"class_list":["post-2222","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-phishing-social-engineering","tag-deep","tag-defense","tag-federal","tag-hacking","tag-investigators","tag-negotiators","tag-phishing","tag-ransomware","tag-security-awareness","tag-shinyhunters","tag-social-engineering","tag-syndicate","tag-ties","tag-uncover"],"_links":{"self":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/2222","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/users\/16"}],"replies":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2222"}],"version-history":[{"count":0,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/2222\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/media\/2221"}],"wp:attachment":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2222"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2222"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2222"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}