Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site – Krebs on Security

Hackers aligned with the ShinyHunters banner have claimed responsibility for dozens of major data breaches since 2019. In its early days, the group was primarily operated by cybercriminals residing in France. As those original members were systematically arrested or jailed by law enforcement, control over the ShinyHunters brand eventually shifted to "Rey," an administrator identified last year as a teenage hacker based in Amman, Jordan. According to estimates from the FBI, ShinyHunters has successfully extorted more than $70 million from corporate and institutional victims this year alone.

The group’s brazen activities reached a climax in late September, when ShinyHunters compromised the FBI recruitment website, fbijobs.gov. The hackers taunted federal law enforcement by threatening to publish a cache of stolen sensitive files. Reportedly, the compromised data included medical and psychological records, Social Security numbers, home addresses, and detailed information regarding the unit and specialization of individual bureau employees.

This high-profile breach of an agency website prompted the FBI to move with extraordinary speed to arrest, detain, and question individuals suspected of communicating with Rey or other key members of the hacking collective. On October 3, Reuters reported that Rey had been detained by Jordanian authorities and was actively cooperating with the FBI.

Rey had managed to assume effective control over the hacking group following the sudden apprehension of one of its alleged senior members. On the evening of September 15, 2026, law enforcement authorities in the Netherlands carried out a dramatic raid, arresting convicted hacker and ShinyHunters suspect Pepijn van der Stap. Dutch police reportedly deployed flash-bang grenades to stun and apprehend Van der Stap while he was actively logged into various online accounts.

According to sources close to the investigation, authorities seized control of Van der Stap while he was using his Signal instant messaging application. This tactical advantage allowed investigators to read recent communications with his frequent contacts, including ransomware negotiators operating out of Canada and the United States.

Multiple sources with direct knowledge of the matter revealed to KrebsOnSecurity that Van der Stap’s decrypted Signal messages became the critical breakthrough needed to unravel a disturbing murder-for-hire plot that surfaced immediately following his arrest. The Dutch news outlet RTL reported last month that two murders were allegedly planned to be carried out abroad, with indications pointing to Van der Stap as the individual who issued the orders, though there is currently no indication that the contracts were ever executed.

Building on these digital trails, the FBI executed an arrest on October 9, taking 54-year-old Canadian cybersecurity executive Edward Dubrovsky into custody in connection with the sprawling ShinyHunters probe. Dubrovsky, who recently published a book on handling cyber extortion that explicitly recommended always engaging with hackers, was formally charged with threatening to disclose stolen data and interfering with interstate commerce through extortion, according to federal court records. Politico reported that prosecutors requested Dubrovsky be held in custody pending trial, and that case-related records remain under seal.

A source close to the investigation disclosed that Van der Stap’s Signal logs showed frequent, intimate conversations between the Dutch hacker, Dubrovsky, and at least one executive at a large U.S.-based consulting firm. Alarmingly, these chats indicated that the executives frequently possessed detailed information regarding newly breached ShinyHunters victims before the victim organizations even realized they had been compromised.

Furthermore, federal investigators uncovered what may be one of the most explosive findings of the probe: Dutch hacker logs showed that Dubrovsky was fully aware that ShinyHunters had successfully stolen highly sensitive data from FBI servers. Despite this knowledge, Dubrovsky never informed the bureau of the breach prior to the extortion group publicly threatening on Twitter/X to publish the agency’s deeply personal personnel files.

SHINYWIRE

Investigative leads pursued by the FBI have also led to the discovery that at least one executive at a prominent U.S.-based consulting firm played an active, operational role in running "shinywire[.]com," a now-defunct extortion portal utilized by ShinyHunters. While KrebsOnSecurity is currently withholding the name of the U.S. company and the suspected executive because formal criminal charges have not yet been filed, the enterprise is recognized as a prestigious firm employing more than 1,000 associates.

The Shinywire website remained active from approximately May 3, 2026, until October 16, hosting listings for nearly 100 organizations that had fallen victim to ShinyHunters intrusions. Each entry on the portal was designed to pressure victim entities into engaging with the cybercriminal syndicate to discuss payment terms. The pages featured samples of stolen proprietary files and explicitly promised that the full trove of data would be leaked online if the victim ignored the extortion demands.

Among the organizations targeted on the platform was Intuitive Surgical, an American medical technology company breached in March 2026 after an employee fell victim to a targeted phishing campaign. Under the operating model of the portal, victim organizations that refused to negotiate within a strict seven-day window found all of their stolen data publicly released on the ShinyHunters shaming blog, which is accessible exclusively via the Tor anonymity network.

The legal and professional fallout surrounding these networks has already begun fracturing executive relationships in the cybersecurity sector. In mid-October, reports surfaced detailing a bitter legal battle initiated by Edward Dubrovsky in Ontario courts against Daniel Tobok, the former chief executive of Cypfer, a global cybersecurity firm founded in Toronto with international offices. The two men initially partnered in 2017 to build Cypfer, where Dubrovsky served as managing partner and chief operating officer. However, by 2024, the professional partnership dissolved amid accusations that Tobok was marginalizing Dubrovsky and making erratic business decisions. Tobok denied the allegations and filed a counterclaim accusing Dubrovsky of misappropriating confidential information and competing unfairly through a separate entity, CyberSteward Inc.

GHOSTBYTE

As investigators dig deeper into the backgrounds of key figures in the ransomware negotiation ecosystem, records and interviews have shed light on older underground associations. According to former colleagues of Daniel Tobok, he was known to ransomware purveyors years ago by the moniker "Ghostbyte."

In 2018, a Canadian company targeted by Dharma—a prolific, Russian-language ransomware affiliate program operational since 2016—sought guarantees that the threat actors would honor an agreement to decrypt locked files if paid. In a redacted email reply recovered from the incident, a Dharma representative explicitly directed the victim to contact an IT professional associated with the email address [email protected]. The cybercriminals advised the victim that this Canadian IT firm routinely resolved such issues and could facilitate the required assurances.

While it remains unclear whether Tobok actively used the Ghostbyte address provided by the Dharma representative, and Tobok has not responded to multiple requests for comment, breach-tracking services indicate connections between accounts. Constella Intelligence discovered that an email address frequently used by Tobok—[email protected]—was linked to online accounts utilizing the username "ghostbyte," including a Snapchat profile. Furthermore, the cryptocurrency wallet associated with the Dharma representative’s email address processed dozens of transactions totaling millions of dollars during that era.

In response to inquiries regarding these developments, Cypfer issued a statement clarifying that the company’s business model does not involve making or facilitating ransomware payments, and emphasizing that they had no prior knowledge of Dubrovsky’s arrest before media reports emerged. The firm noted that it has received no outreach from law enforcement and is not the target of any ongoing federal investigation. Cypfer was recently acquired by Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group, which previously acquired Cytelligence, a firm founded by Tobok where Dubrovsky also served as managing partner.

CONFLICTING INTERESTS

Under U.S. law, paying a ransom to obtain decryption keys or secure promises to delete stolen files is not inherently illegal, provided the ransomware group is not designated on the U.S. Treasury Department’s sanctions list. ShinyHunters currently holds no such official sanctions designation. However, corporate victims frequently find themselves caught in a web of conflicting industry incentives.

Victim organizations are often directed by cyber insurance providers to engage specialized incident response firms. Yet, not all forensic companies agree to facilitate ransom payments. Firms that refuse to reward extortionists are frequently sidelined by clients in favor of providers willing to process the payments. This dynamic introduces a profound conflict of interest, particularly when negotiation firms charge fees calculated as a percentage of the total ransom paid.

Industry leaders have increasingly criticized this financial model. Mark Camillo, chief executive of CyberAcuView—an industry group established by major cyber insurance carriers—pointed out that negotiators charging a percentage fee possess a perverse financial incentive to drive up ransom amounts rather than negotiate them down. While negotiation firms defend these structures by citing the escalating risks, float management, and high transaction costs associated with cryptocurrency exchanges, law enforcement scrutiny is intensifying.

Recent federal prosecutions highlight the growing legal peril surrounding corrupt negotiation practices. On October 7, the Department of Justice charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy for allegedly charging customers to remediate cyberattacks without paying hackers, only to secretly pay out millions behind his clients’ backs. Similarly, in July, Florida ransomware negotiator Angelo Martino was sentenced to 70 months in prison for conspiring with the BlackCat/ALPHV ransomware group to provide confidential client negotiating strategies to cybercriminals, maximizing extortion payouts at the expense of corporate victims.