By Nana Muazin 
U.S. federal investigators pursuing the prolific ShinyHunters hacking group—which recently compromised highly sensitive data belonging to the Federal Bureau of Investigation—have identified executives at two different ransomware negotiation firms who maintained unusually close and illicit relations with the extortion syndicate. Sources close to the ongoing investigation revealed that one of these U.S.-based executives even actively assisted ShinyHunters in operating a public website specifically designed to pressure victim organizations into paying extortion demands.
Hackers aligned with the ShinyHunters banner have claimed responsibility for dozens of major, high-profile data breaches since 2019. During its initial years, the collective was primarily operated by cybercriminals residing in France. However, as those original members were systematically arrested, prosecuted, and jailed one by one, control over the ShinyHunters brand eventually transitioned to an administrator known as "Rey." Last year, investigators identified Rey as a teenage hacker operating out of Amman, Jordan. According to official estimates provided by the FBI, the ShinyHunters network has successfully extorted more than $70 million from corporate and government victims so far this year alone.
The group’s brazen operations reached a critical inflection point in late September, when ShinyHunters successfully breached the FBI recruitment portal, fbijobs.gov. The attackers immediately taunted federal law enforcement by threatening to publish a cache of stolen internal files. Reports indicated that the pilfered data included deeply sensitive records, such as employee medical and psychological evaluations, Social Security numbers, home addresses, and specific details regarding each personnel member’s unit and professional specialization.
This direct assault on an FBI recruitment website prompted the bureau to move with uncommon speed, arresting, detaining, and questioning individuals who maintained any form of communication with Rey or other identified ShinyHunters suspects. Reuters reported that Rey was detained by Jordanian authorities and has since been cooperating fully with the FBI.
Rey’s ascent to leadership within the hacking collective was made possible because one of its alleged senior figures had just been neutralized. On the evening of September 15, law enforcement officers in the Netherlands executed a high-risk raid, arresting convicted hacker and primary ShinyHunters suspect Pepijn van der Stap. Dutch police reportedly deployed flash-bang grenades in an effort to stun and apprehend Van der Stap precisely while he remained actively logged into various online accounts.
According to sources close to the investigation, authorities apprehended Van der Stap while he was actively using his Signal instant messaging application. This tactical advantage allowed investigators to immediately review his recent communications with frequent contacts, which included active ransomware negotiators based both in Canada and the United States.
Multiple sources with direct knowledge of the matter disclosed that Van der Stap’s recovered Signal messages proved vital to unraveling an entirely separate criminal plot: a murder-for-hire scheme that surfaced immediately following his arrest. The Dutch news outlet RTL reported that two murders were allegedly planned to be carried out abroad, with investigators finding strong indications that Van der Stap had issued the orders for the attacks, though there is no evidence to suggest those violent orders were ever successfully executed.
The digital trail soon led directly to the executive suite of the cybersecurity industry. On October 9, federal authorities arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the broadening ShinyHunters probe. Dubrovsky had recently published a book on handling cyber extortion that explicitly recommended always engaging directly with hackers. According to court records, he was formally charged with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion. Politico reported that federal prosecutors requested Dubrovsky remain in custody pending trial, and that all records associated with his criminal case remain strictly under seal.
A source close to the investigation revealed that Van der Stap’s Signal message logs demonstrated frequent, direct conversations between the Dutch hacker, Dubrovsky, and at least one executive at a major U.S.-based consulting firm. Troublingly, these communications showed that the executives often possessed detailed knowledge of new ShinyHunters victims well before the targeted organizations themselves had even discovered they were breached.
Furthermore, investigators uncovered what they described as a potentially explosive finding within the Dutch hacker’s chat logs: Dubrovsky was fully aware that ShinyHunters had exfiltrated highly sensitive personnel data directly from official FBI servers. Despite this knowledge, Dubrovsky never notified the bureau of the massive data breach prior to ShinyHunters publicizing their extortion threats on social media platform X, formerly known as Twitter.
SHINYWIRE
As the probe widened, investigators unearthed more evidence regarding the technical infrastructure used to pressure victims. Sources close to the ShinyHunters investigation revealed that federal agents believe at least one executive at a prominent U.S.-based consulting firm played an active, hands-on role in operating the now-defunct ShinyHunters victim extortion portal, known as shinywire[.]com. While the U.S. firm and the suspected executives have not yet been publicly named because formal criminal charges have not been filed, the organization is described as a prestigious enterprise with more than 1,000 associates.
The Shinywire domain remained active from approximately May 3 until October 16, featuring listings for nearly 100 distinct corporate and institutional organizations compromised by ShinyHunters. Each entry on the portal urged victim entities to immediately engage with the cybercrime syndicate to negotiate payment terms. The web pages also displayed authentic samples of stolen files, accompanied by explicit warnings that the full data caches would be permanently published online if corporate leadership ignored the financial demands.
Cached records and indexing services like urlscan.io preserved portions of the extortion portal, including a prominent listing targeting Intuitive Surgical, an American medical technology company breached after an employee fell victim to a targeted phishing email attack. Under the group’s standard operating procedure, victim organizations that refused to engage or negotiate within a strict seven-day window found all of their confidential stolen data leaked onto the primary ShinyHunters shaming blog, which was hosted exclusively on the Tor anonymity network.
The fallout from these arrests also exposed pre-existing corporate feuds within the Canadian cybersecurity sector. Local reporting noted that months prior to his arrest, Edward Dubrovsky had filed a civil lawsuit in Ontario alleging he had become collateral damage in an aggressive campaign by a former business partner designed to systematically destroy another industry executive.
The lawsuit targeted Daniel Tobok, the former chief executive of Cypfer, a prominent cybersecurity firm founded in Toronto with international offices spanning the United States, Britain, the Netherlands, the United Arab Emirates, and Mexico. Dubrovsky and Tobok initially became business partners in 2017 and subsequently built Cypfer together, with Dubrovsky serving as a managing partner and chief operating officer. However, by 2024, their professional relationship had deteriorated significantly, with Dubrovsky accusing Tobok of gradually freezing him out of critical business decisions and exercising increasingly capricious management practices. Tobok denied the allegations and filed a counter-claim, accusing Dubrovsky of misappropriating confidential information and establishing a competing venture under the name CyberSteward Inc., while allegedly misrepresenting his status as an original company founder.
GHOSTBYTE
Interviews with several former colleagues of Daniel Tobok revealed that as far back as eight years ago, he was known within specific ransomware circles by a distinct alias: Ghostbyte. In 2018, a Canadian corporation suffered a debilitating cyberattack orchestrated by Dharma, a prolific Russian-language ransomware affiliate program that first emerged in 2016. When the victim company informed the Dharma representative that they were leaning toward paying the ransom because critical encrypted files were unrecoverable, they requested stronger guarantees that the hackers would honor their word upon payment.
A redacted copy of the Dharma representative’s email reply advised the victim to contact an independent IT company capable of providing such guarantees. The ransomware affiliate explicitly directed the victim to reach out to an email address listed as [email protected]. The reply stated that the IT company frequently resolved such situations in Canada, instructing the victim to establish a formal service contract.
While it remains unclear whether Tobok ever actively utilized the Ghostbyte email address provided by the Dharma representative, public records services like Constella Intelligence identified a direct digital connection. Constella discovered that an email address frequently used by Tobok—[email protected]—was directly associated with two online user accounts that utilized the exact handle "ghostbyte," including a Snapchat account. Furthermore, Constella’s tracking linked the Dharma representative’s fallback email address to a specific cryptocurrency wallet address that processed dozens of transactions totaling roughly 43 bitcoin, valued at approximately $3.5 million at current market rates.
In an official statement addressing the controversy, Cypfer clarified that the company’s established business model does not include making or facilitating ransomware payments. Representatives stated that leadership first learned of Dubrovsky’s federal arrest through mainstream media reports, emphasizing that the firm had received no outreach from law enforcement and was not the target of any active criminal investigation.
The statement further noted that CyberSteward and Cypfer operate as entirely separate entities with no shared officers, directors, or employees, and highlighted Cypfer’s recent acquisition by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. Aon previously acquired Cytelligence, a security consulting firm where Tobok served as founder and CEO and Dubrovsky served as a managing partner.
CONFLICTING INTERESTS
Under U.S. law, it is not explicitly illegal to pay hackers for an encryption key to restore locked servers or in exchange for a binding promise to delete stolen data. However, victim organizations face severe legal liabilities if they remit payments to ransomware syndicates currently designated under federal sanctions by the U.S. Treasury Department, though ShinyHunters has not been formally added to those restricted lists.
Industry experts note that ransomware victims are frequently guided by their cyber insurance providers to retain specific incident response firms. Yet, philosophical divisions run deep within the sector; not all forensics firms agree to facilitate extortion payments. When victims decide to pay against the advice of conservative advisors, they often replace those firms with remediation companies willing to process the transactions.
For example, when ShinyHunters targeted education technology giant PowerSchool, exfiltrating private records belonging to 62 million students and 9.5 million teachers across North America, the company ultimately paid a $2.85 million ransom demand with the assistance of CyberSteward. Despite the payment, individual school districts subsequently received separate ransom demands utilizing samples of the exact same stolen datasets, underscoring the stark reality that no technical mechanism exists to verify whether threat actors have truly purged stolen files as promised.
In response, leading incident response firms such as Coveware and Unit 221B have consistently warned corporate victims against paying the ShinyHunters syndicate, explaining that supposedly destroyed victim data is routinely retained, resold, or weaponized to directly target corporate clients later. The FBI echoed these warnings in an official public service announcement advising against paying the group, which reportedly enraged ShinyHunters leadership as it severely impacted their monetization rates.
Internal messaging logs reviewed by investigators revealed that the operators of the primary ShinyHunters Telegram channel repeatedly complained about Coveware’s public advisories. In May 2026 conversations with co-conspirators, the syndicate lamented that most victim companies would have paid had it not been for Coveware’s intervention, explicitly discussing ways to eliminate what they characterized as an operational hurdle.
Mark Camillo, chief executive of CyberAcuView—an industry group established by major cyber insurance carriers—pointed out an inherent conflict of interest within the negotiation ecosystem. While some remediation firms charge flat retainer fees, others operate on a contingency model, charging a percentage of the total ransom negotiated and paid. Camillo noted that this financial structure creates a perverse incentive for negotiators to favor attackers, maximizing payouts rather than aggressively driving down ransom figures.
The U.S. Department of Justice has increasingly targeted these conflicts through criminal prosecutions. In October, federal authorities charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy after he allegedly charged clients millions for remediation while secretly paying hackers behind their backs. Similarly, in July, a Florida-based ransomware negotiator was sentenced to prison time for conspiring with the BlackCat ransomware group to pass confidential client negotiation strategies directly to the attackers, enabling them to maximize their extortion profits.
Ali Ikhwan 
Basiran 
Pevita Pearce