By Ali Ikhwan 
U.S. federal investigators pursuing the prolific ShinyHunters hacking group—which recently shocked the cybersecurity community by stealing highly sensitive data from the FBI—have identified executives at two different ransomware negotiation firms who maintained unusually close and suspicious relations with the cybercrime organization. Sources close to the active investigation say one of the U.S.-based executives even went so far as to help ShinyHunters operate an active website designed to pressure breached victims into paying lucrative ransom demands.
Hackers aligned with ShinyHunters have claimed public credit for dozens of major corporate and institutional data breaches since 2019. During its early years, the collective was primarily operated by cybercriminals residing in France. However, as those original members were systematically identified, arrested, and jailed by international law enforcement, control over the ShinyHunters brand eventually passed to an administrator known online as "Rey." Last year, investigators identified Rey as a teenage hacker operating out of Amman, Jordan. According to official figures cited by the FBI, the ShinyHunters network has successfully extorted more than $70 million from corporate and government victims so far this year alone.
The group’s operations crossed a critical threshold in late September when ShinyHunters successfully compromised the FBI recruitment portal, fbijobs.gov. To mock federal law enforcement, the hackers threatened to publicly release a trove of stolen internal files. Reports indicated that the pilfered data included sensitive medical and psychological records, Social Security numbers, home addresses, and detailed professional information regarding each employee’s specific unit and specialization within the bureau.
The audacious hack of the FBI jobs site prompted the agency to move with uncommon speed, tracking down, detaining, and questioning individuals who had established any digital communications with Rey or other key ShinyHunters suspects. On October 3, Reuters reported that Rey had been detained by Jordanian authorities and was actively cooperating with the FBI.
Rey’s rise to power within the group had been facilitated by a vacuum left after one of the collective’s alleged senior members was suddenly apprehended. On the evening of September 15, law enforcement officers in the Netherlands executed a high-stakes arrest, utilizing flash-bang grenades in an effort to stun and capture convicted hacker and ShinyHunters suspect Pepijn van der Stap as he remained actively logged into various online accounts.
According to sources close to the unfolding investigation, Dutch authorities apprehended Van der Stap while he was actively using his Signal instant messaging account. This tactical advantage allowed investigators to immediately review recent communications with frequent contacts, including ransomware negotiators based in Canada and the United States. Multiple sources with direct knowledge of the matter told KrebsOnSecurity that Van der Stap’s recovered messages served as the crucial key to unraveling a disturbing murder-for-hire plot that surfaced immediately following his arrest. Last month, Dutch news outlet RTL reported that two murders were allegedly planned to be carried out abroad, with strong indications suggesting Van der Stap had issued the orders for the attacks, though there is no evidence indicating those plots were ever successfully executed.
The fallout from the Dutch raid quickly crossed international borders. On October 9, KrebsOnSecurity broke the news that the FBI had arrested a 54-year-old Canadian cybersecurity executive named Edward Dubrovsky in connection with the broader ShinyHunters investigation. Dubrovsky, who recently published a book on handling cyber extortion that explicitly recommended always engaging directly with hackers, was formally charged with threatening to disclose stolen data and interfering with interstate commerce through extortion, according to federal court records. Politico reported that federal prosecutors subsequently asked that Dubrovsky remain in federal custody pending trial, and that all records associated with his criminal case remain strictly under seal.
A confidential source close to the investigation revealed that Van der Stap’s recovered Signal messages demonstrated he engaged in frequent, detailed conversations with Dubrovsky as well as at least one executive at a large U.S.-based consulting firm. Troublingly, these executives frequently possessed intimate details regarding newly compromised ShinyHunters victims before the victimized organizations themselves had even discovered or acknowledged the security breaches.
Furthermore, investigators uncovered what may be one of the most explosive findings of the probe: the Dutch hacker’s chat logs showed that Dubrovsky was fully aware that ShinyHunters had successfully stolen deeply sensitive data from official FBI servers. Despite this knowledge, Dubrovsky never alerted the bureau to the data breach prior to ShinyHunters publicly threatening on Twitter/X to publish the agency’s confidential personnel files.
SHINYWIRE
As the investigation deepened, federal authorities uncovered further operational ties between the hacking syndicate and corporate intermediaries. KrebsOnSecurity learned from two separate sources close to the ShinyHunters probe that FBI investigators believe at least one executive at a prominent U.S.-based consulting firm played an active, hands-on role in operating the now-defunct ShinyHunters victim extortion portal, known as "shinywire[.]com." While investigators have identified the firm—a prestigious organization with more than 1,000 associates—publishing details has been withheld because formal criminal charges have not yet been filed against the specific executive or company.
The Shinywire website remained active from approximately May 3, 2026, until October 16, hosting profiles for nearly 100 organizations that had been compromised by ShinyHunters. Each entry on the portal was designed to pressure victim companies into engaging with the cybercrime syndicate to negotiate payment terms. The web pages prominently displayed samples of stolen corporate files and warned that the complete data sets would be published online permanently if the victim ignored the extortion demands.
Among the organizations listed on the site was Intuitive Surgical, an American medical technology company that suffered a breach in March 2026 after an employee fell victim to a targeted phishing email attack that compromised corporate credentials. Under the mechanics of the scheme, victim organizations that refused to negotiate or respond within a strict seven-day window found all of their stolen data dumped onto the ShinyHunters victim shaming blog, a hidden site reachable exclusively via the anonymity network Tor.
The complex web of industry relationships faced further public scrutiny when The Globe and Mail reported that, months prior to his arrest, Edward Dubrovsky had filed a lawsuit in Ontario alleging he had become collateral damage in a bitter campaign by a former business partner seeking to "destroy" another industry executive. Dubrovsky’s legal action targeted Daniel Tobok, the former chief executive of Cypfer, a Toronto-headquartered cybersecurity firm maintaining offices across the United States, Britain, the Netherlands, the United Arab Emirates, and Mexico.
The two men had initially become business partners in 2017 to build Cypfer, where Dubrovsky served as a managing partner and chief operating officer. However, by 2024, their relationship deteriorated significantly. Dubrovsky alleged that Tobok gradually excluded him from key business matters and made increasingly capricious decisions. Tobok strongly denied the allegations, filing a counterclaim accusing Dubrovsky of improperly accessing confidential information and engaging in unfair competition through work with another entity called CyberSteward Inc. Tobok also maintained that Dubrovsky had misrepresented his status as a Cypfer founder and held no equity shares in the company.
GHOSTBYTE
The competitive landscape of digital extortion revealed even deeper historical roots during the investigation. Interviews with several former colleagues of Daniel Tobok indicate that as far back as eight years ago, he was known among ransomware purveyors by a specific digital moniker: "Ghostbyte."
In 2018, a Canadian company fell victim to Dharma, a prolific Russian-language ransomware affiliate program that first emerged in 2016. When the victim informed the Dharma ransomware representative that they were leaning toward paying the ransom because critical encrypted files were unrecoverable, they requested stronger guarantees that the hackers would honor their word upon payment.
A redacted copy of the Dharma representative’s email reply advised the victim to contact a specific individual at a Canadian IT firm known for handling such guarantees. The hacker explicitly recommended reaching out to the email address [email protected]. "If you want guarantees, you can write to the IT company," the Dharma representative advised in the correspondence. "Take the phone and negotiate with them. This IT company often solves such problems in Canada. You can contact them and sign a contract for services. You’ll still have to pay."
While it remains unclear whether Tobok personally utilized the Ghostbyte address provided by the Dharma affiliate, he has consistently declined to respond to multiple requests for comment. However, records from breach-tracking service Constella Intelligence indicate that an email address frequently used by Tobok—[email protected]—was linked to two online accounts utilizing the username "ghostbyte," including a Snapchat account. Furthermore, Constella analysis revealed that the Dharma representative’s email address, [email protected], tied directly to a cryptocurrency wallet that processed 38 transactions totaling 43 bitcoins, valued at approximately $3.5 million at contemporary rates, with the latest recorded transaction dated February 2019.
In an official statement released on October 14, Cypfer stated that its core business operations do not include making or facilitating ransomware payments. The company asserted that it learned of Dubrovsky’s arrest exclusively through media reports. "We had no prior knowledge of Mr. Dubrovsky’s arrest," a Cypfer spokesperson stated via email. "Cypfer has not received any outreach from law enforcement and, to our knowledge, is not the target of any law enforcement investigation."
The statement further clarified that CyberSteward and Cypfer operate as entirely separate entities sharing no common officers, directors, or employees. Cypfer was recently acquired by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. Aon previously acquired Cytelligence in 2020, a security consulting firm where Tobok served as founder and CEO and Dubrovsky functioned as a managing partner.
CONFLICTING INTERESTS
The legal and ethical boundaries surrounding ransomware negotiations remain complex. Under United States law, paying hackers to obtain an encryption key or secure a promise to delete stolen files is not inherently illegal, provided the victim does not disburse funds to a group formally sanctioned by the U.S. Treasury Department. Because ShinyHunters is not currently sanctioned by the U.S. government or international authorities, direct payments do not automatically trigger sanctions violations.
Industry experts note that cyber insurance providers typically direct victim organizations to collaborate with specific incident response firms. However, not all digital forensics companies agree to facilitate ransom payments on behalf of clients. Consequently, firms that refuse to reward extortionists are often replaced by entities willing to negotiate payouts.
A prominent example occurred in December 2024, when ShinyHunters targeted education technology provider PowerSchool, stealing private records concerning 62 million students and 9.5 million teachers across the U.S. and Canada. PowerSchool reportedly paid a $2.85 million ransom demand. Frequently asked questions documents regarding the breach noted that PowerSchool was assisted by CyberSteward during the ordeal. A 20-year-old ShinyHunters affiliate from Sterling, Massachusetts, Matthew Lane, was subsequently sentenced in November 2025 to four years in federal prison for his admitted role in the PowerSchool hack.
Despite the ransom payment, the settlement failed to prevent subsequent exploitation of the stolen data. By May 2025, individual school districts began receiving separate extortion demands utilizing samples from the exact same stolen database. While no evidence suggests ShinyHunters orchestrated the secondary extortion wave, the incident underscores the reality that no technical mechanism exists to verify whether threat actors have truly deleted stolen data as promised, or to prevent unauthorized third parties from abusing compromised files.
Several leading incident response firms, including Coveware and Unit 221B, have consistently warned corporate victims against paying ShinyHunters, pointing out that supposedly destroyed data is frequently retained, resold, or leveraged to directly target a company’s clients. The FBI echoed these warnings in an official public service announcement on May 15, strongly advising organizations against yielding to ShinyHunters’ demands. In response to these industry-wide warnings, members of the hacking group launched campaigns of harassment and threats against employees at Coveware and Unit 221B.
Private communications obtained from Telegram channels highlighted the frustration of ShinyHunters leadership regarding Coveware’s anti-payment advisories. In a conversation on May 6 between the group’s primary account and a co-conspirator, the hackers complained that Coveware was actively damaging their conversion rates. "Go on my website, majority of those companies would’ve paid if it weren’t for Coveware giving them misinformation," the ShinyHunters account wrote, adding in an earlier April chat that they were actively looking to "eliminate the problem" posed by Coveware’s guidance. Coveware declined to comment on the matter.
Mark Camillo, chief executive of CyberAcuView—an industry group established in 2021 by a consortium of major cyber insurance carriers—pointed out that fee structures within the negotiation sector create inherent conflicts of interest. While some firms operate on a flat retainer model, others that specialize in ransom negotiations charge a variable percentage of the total payout. Camillo argued that this financial model incentivizes negotiators to favor the attackers’ terms rather than aggressively driving down the price.
"It has come to the industry’s attention that many of the ransomware payers charge a percentage of the final payment which may or may not be disclosed," Camillo said. "This makes no sense if they are also the negotiator. There needs to be more transparency in the process as no one in the ecosystem should be profiting purely on the size of the ransomware transaction or payment itself."
Federal prosecutors have increasingly turned their attention toward illicit practices within the negotiation ecosystem. On October 7, the Department of Justice charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy for allegedly charging clients substantial fees to remediate ransomware attacks without paying hackers, while secretly paying extortionists $8 million behind his customers’ backs while billing clients a total of $19 million. Earlier in July, Angelo Martino, a 41-year-old ransomware negotiator from Florida, was sentenced to 70 months in prison for conspiring with the BlackCat/ALPHV ransomware group to extort multiple victims by leaking confidential negotiation strategies to maximize payouts.
Basiran 
Pevita Pearce 
Asro