By Reynand Wu 
U.S. federal investigators pursuing the prolific ShinyHunters hacking group—which recently compromised highly sensitive data belonging to the Federal Bureau of Investigation—have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion syndicate. Sources close to the ongoing investigation revealed that one of these executives, based in the United States, even assisted ShinyHunters in operating a dedicated website designed to pressure victim organizations into coughing up ransom payments.
The ShinyHunters cybercriminal network has claimed responsibility for dozens of major data breaches dating back to 2019. During its earlier years, the group was primarily operated by cybercriminals residing in France. As those original members were systematically arrested or jailed by international law enforcement, control over the ShinyHunters brand eventually drifted to an administrator known online as “Rey.” Last year, investigators identified Rey as a teenage hacker operating out of Amman, Jordan. According to estimates from the FBI, ShinyHunters has successfully extorted more than $70 million from corporate and government victims so far this year.
The group’s operations escalated dramatically in late September, when hackers aligned with ShinyHunters breached the FBI recruitment website, fbijobs.gov. The attackers taunted federal law enforcement by threatening to publish the stolen files online. According to reports, the stolen cache included highly sensitive personnel information, such as medical and psychological records, Social Security numbers, home addresses, and specific details regarding each employee’s unit and professional specialization.
This brazen breach of a federal law enforcement portal prompted the FBI to move with uncommon speed, tracking down, detaining, and questioning individuals who had maintained any form of communication with Rey or other suspects linked to ShinyHunters. On October 3, Reuters reported that Rey had been detained by Jordanian authorities and was actively cooperating with federal investigators.
Rey had been able to assume control over the hacking group because one of its primary senior members had just been neutralized. On the evening of September 15, law enforcement officers in the Netherlands arrested convicted hacker and prominent ShinyHunters suspect Pepijn van der Stap. Dutch police reportedly deployed flash-bang grenades to stun and apprehend Van der Stap while he was actively logged into several of his online accounts.
According to sources close to the investigation, authorities apprehended Van der Stap while he was using his Signal instant messaging account. This immediate physical capture allowed law enforcement to access and read recent communications with frequent contacts, including ransomware negotiators located in Canada and the United States.
Multiple sources with direct knowledge of the matter indicated that Van der Stap’s decrypted Signal messages served as the crucial key to unraveling a murder-for-hire plot that surfaced immediately following his arrest. Dutch news outlet RTL reported last month that two murders were allegedly planned to be committed abroad, with strong indications that Van der Stap had issued the orders for the attacks, though officials noted there is no evidence those orders were ever successfully carried out.
On October 9, it was revealed that the FBI had arrested a 54-year-old Canadian cybersecurity executive named Edward Dubrovsky in connection with the broadening ShinyHunters investigation. Dubrovsky, who recently authored a book on handling cyber extortion that recommended always engaging directly with hackers, faces federal charges of threatening to disclose stolen data and interfering with interstate commerce through extortion, according to federal court records. Politico reported that federal prosecutors requested Dubrovsky remain in custody pending trial, and that all records associated with his criminal case remain sealed under judicial order.
A source close to the investigation shared that Van der Stap’s Signal messages demonstrated frequent, direct conversations between the Dutch hacker, Dubrovsky, and at least one executive at a large U.S.-based consulting firm. Troublingly, these executives often possessed detailed knowledge of newly targeted ShinyHunters victims before the victim organizations themselves had even discovered or acknowledged the security breaches.
Furthermore, investigators uncovered what they consider a potentially explosive finding: the Dutch hacker’s chat logs showed that Dubrovsky was fully aware that ShinyHunters had exfiltrated highly sensitive data from FBI servers. Despite this knowledge, Dubrovsky never informed the bureau of the intrusion prior to ShinyHunters publicly threatening on social media platform X to publish the agency’s deeply personal personnel files.
SHINYWIRE
Federal investigators probing the ShinyHunters network believe that at least one executive at a prominent U.S.-based consulting firm played an active, operational role in managing the now-defunct victim extortion website known as shinywire[.]com. While law enforcement has not yet publicly named the U.S. company or the suspected executive due to pending formal charges, the entity is described as a prestigious firm employing more than 1,000 associates.
The Shinywire portal was active from approximately May 3, 2026, until October 16, featuring listings for nearly 100 organizations that had been compromised by ShinyHunters. Each entry on the site pressured victim companies to engage with the cybercrime syndicate to negotiate payment terms. The pages also displayed samples of stolen files, accompanied by explicit warnings that the entire cache would be published online if the victim ignored the extortion demands.
Organizations that refused to engage or negotiate within a seven-day window found all of their stolen data publicly released on the main ShinyHunters victim shaming blog, a site reachable exclusively via the Tor anonymity network.
In a report published on October 15, The Globe and Mail detailed that months prior to his arrest by the FBI, Edward Dubrovsky had filed a lawsuit in Ontario alleging he had become collateral damage in a malicious campaign by a former business partner seeking to destroy another industry executive. Dubrovsky’s lawsuit targeted Daniel Tobok, the former chief executive of Cypfer, a prominent cybersecurity firm founded in Toronto with international offices spanning the United States, Britain, the Netherlands, the United Arab Emirates, and Mexico.
Dubrovsky and Tobok initially became business partners in 2017 to build Cypfer, where Dubrovsky served as managing partner and chief operating officer. However, by 2024, the business relationship had deteriorated significantly. Dubrovsky accused Tobok of gradually excluding him from essential business decisions and making increasingly erratic administrative choices. Tobok denied the allegations and filed a counter-suit accusing Dubrovsky of accessing confidential information, competing unfairly through work at another firm called CyberSteward Inc., and misrepresenting his status as a company founder.
GHOSTBYTE
According to interviews conducted with several former colleagues of Daniel Tobok, he was known among ransomware purveyors as far back as eight years ago by a specific alias: Ghostbyte. In 2018, a Canadian company fell victim to an intrusion by Dharma, a prolific Russian-language ransomware affiliate program active since 2016. When the victim company informed the Dharma representative that they were leaning toward paying the ransom because critical encrypted files were unrecoverable, they requested stronger guarantees that the hackers would honor their word.
In response, the Dharma representative urged the victim to contact a specific individual at a Canadian IT firm specializing in such matters, explicitly recommending that they reach out to the email address [email protected]. The Dharma representative assured the victim that this particular IT company frequently resolved similar problems in Canada and could provide the necessary contractual guarantees.
While it remains unclear whether Tobok personally utilized the Ghostbyte address provided by the ransomware affiliate, and despite Tobok failing to respond to multiple requests for comment, breach tracking service Constella Intelligence discovered a connection. The analysis revealed that an email address frequently used by Tobok—[email protected]—was linked to two online accounts utilizing the username "ghostbyte," including a Snapchat profile. Furthermore, Constella tied the Dharma representative’s email address to a cryptocurrency wallet that had processed dozens of transactions worth millions of dollars.
In a formal statement issued in mid-October, Cypfer asserted that its corporate business model does not include making or facilitating ransomware payments, noting that the firm only learned of Dubrovsky’s arrest through media reports. The company emphasized that it had no prior knowledge of the arrest, had received no outreach from law enforcement, and was not the target of any ongoing government investigation. Cypfer added that CyberSteward and Cypfer operate as entirely separate corporate entities with no overlapping officers, directors, or employees. Cypfer was recently acquired by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. Aon had previously acquired Cytelligence, a security consulting firm where Tobok served as founder and CEO and Dubrovsky as managing partner.
CONFLICTING INTERESTS
Under U.S. law, paying hackers for an encryption key to unlock infected servers or to secure a promise to delete stolen files is not inherently illegal. Victim organizations only face legal penalties if they pay a ransom to a criminal group currently sanctioned by the U.S. Treasury Department, and ShinyHunters is not presently designated under those sanctions lists.
Industry experts note that cyber insurance providers typically direct victims to specific incident response firms. However, not all forensic response companies are willing to facilitate ransom payments on behalf of clients. Consequently, when victim firms decide to pay, those that eschew rewarding extortionists are frequently replaced by firms with fewer ethical qualms regarding extortion payments.
In late 2024, ShinyHunters targeted educational technology company PowerSchool, stealing private data belonging to 62 million students and 9.5 million teachers across the United States and Canada. PowerSchool ultimately paid a ransom demand of $2.85 million. Documentation regarding the incident indicated that PowerSchool was assisted by CyberSteward during the ordeal. A 20-year-old ShinyHunters affiliate involved in the PowerSchool hack was subsequently sentenced to four years in federal prison in November 2025.
Despite the ransom payment, the settlement failed to prevent secondary extortion attempts using the same pilfered dataset. By May 2025, individual school districts began receiving separate ransom demands leveraging samples of the original PowerSchool records. Although authorities did not link ShinyHunters directly to the secondary wave, the incident underscored the harsh reality that victims have no technical guarantee that threat actors have permanently deleted stolen files, nor can they prevent other criminals from exploiting the same leaked records.
Leading cyber incident response firms, including Coveware and Unit 221B, have consistently warned victims against paying ransom to groups like ShinyHunters, pointing out that destroyed data is routinely retained, resold, or used to directly extort corporate clients later. The FBI echoed these exact warnings in a public service announcement advising against paying the syndicate, prompting members of ShinyHunters to actively harass and threaten employees at Coveware and Unit 221B for providing such guidance.
Internal communications reviewed by investigators highlighted the intense frustration of ShinyHunters leadership regarding Coveware’s anti-extortion advice. In private Telegram chats from May and April 2026, the group’s administrators complained bitterly that Coveware was severely harming their business model and lowering their overall payment success rates, even discussing plans to "eliminate the problem." Coveware declined to comment on the matter.
Mark Camillo, chief executive of CyberAcuView—an industry group established by major cyber insurers—pointed out that fee structures within the incident response sector create inherent conflicts of interest. While some firms operate on a flat retainer model, negotiation specialists often charge a percentage of the total ransom paid. Camillo noted that this financial incentive encourages negotiators to favor the attackers’ terms rather than aggressively bargaining down the price.
This dynamic has increasingly drawn the attention of federal prosecutors. On October 7, the Department of Justice charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy for allegedly charging customers millions of dollars for ransomware remediation while secretly paying hackers behind their clients’ backs. Similarly, in July, a Florida ransomware negotiator named Angelo Martino was sentenced to nearly six years in prison for conspiring with the BlackCat ransomware group to extort victims by leaking confidential negotiation strategies to maximize payouts.
Dwi Wanna 
Nila Kartika Wati 
Sagoh