By Asep Darmawan 
U.S. federal investigators pursuing the notorious ShinyHunters hacking group—which recently compromised highly sensitive data belonging to the Federal Bureau of Investigation—have identified executives at two separate ransomware negotiation firms who maintained unusually close and illicit relations with the extortion syndicate. According to sources close to the ongoing federal probe, one of these executives, based in the United States, even went so far as to help ShinyHunters operate a dedicated web portal designed to pressure corporate and institutional victims into paying exorbitant ransom demands.
Hackers aligned with the ShinyHunters banner have claimed credit for dozens of major, high-profile data breaches since 2019. During its initial years, the group was primarily operated by cybercriminals residing in France. However, as those original members were systematically arrested or jailed by international law enforcement agencies, operational control over the ShinyHunters brand eventually transitioned to a teenage hacker from Amman, Jordan, known online as “Rey,” whose real identity was publicly revealed late last year. According to estimates provided by the FBI, the ShinyHunters enterprise has successfully extorted more than $70 million from various corporate and government victims over the course of this year alone.
The group’s brazen activities reached a dramatic peak in late September, when hackers linked to ShinyHunters breached the official FBI recruitment website, fbijobs.gov. To taunt federal law enforcement, the threat actors threatened to publish the stolen repository of sensitive files online. According to reports, the compromised data reportedly included deeply personal employee information, such as medical and psychological records, Social Security numbers, home addresses, and specific details regarding each employee’s operational unit and professional specialization.
This unprecedented breach of a federal law enforcement recruitment portal prompted the FBI to move with uncommon speed, tracking down, detaining, and questioning individuals who had maintained any form of digital communication with Rey or other primary suspects associated with ShinyHunters. On October 3, Reuters reported that Rey had been successfully detained by Jordanian authorities and was actively cooperating with federal investigators.
Rey’s rise to a position of administrative control over the hacking group was facilitated by the sudden neutralization of one of its alleged senior members. On the evening of September 15, law enforcement authorities in the Netherlands executed a high-stakes tactical raid, arresting convicted hacker and prominent ShinyHunters suspect Pepijn van der Stap. Dutch police reportedly deployed flash-bang grenades in an effort to stun and quickly apprehend Van der Stap precisely while he remained actively logged into various online accounts.
According to a source close to the investigation, Dutch authorities apprehended Van der Stap while he was actively using his Signal instant messaging account. This tactical timing granted investigators immediate access to recent, unencrypted communications with his most frequent contacts, including ransomware negotiators operating out of Canada and the United States.
Multiple knowledgeable sources confirmed to investigators that Van der Stap’s recovered Signal messages proved vital in unraveling an alarming murder-for-hire plot that surfaced immediately following his apprehension. The Dutch news outlet RTL reported last month that two targeted murders were allegedly scheduled to be executed abroad, and that digital evidence indicated Van der Stap had issued the direct orders for the attacks, though there is no indication those violent orders were ever successfully carried out.
The intelligence gathered from Van der Stap’s devices quickly rippled across international borders. On October 9, federal authorities arrested a 54-year-old Canadian cybersecurity executive named Edward Dubrovsky in connection with the expanding ShinyHunters investigation. Dubrovsky, who had recently authored and published a book on handling corporate cyber extortion that explicitly recommended always engaging directly with hackers, was formally charged with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion, according to federal court records. Media reports indicate that federal prosecutors have strongly requested that Dubrovsky remain in federal custody pending trial, and that all court records related to his specific case remain heavily under seal.
A source close to the investigation revealed that Van der Stap’s Signal message logs demonstrated frequent, direct conversations between the Dutch hacker, Dubrovsky, and at least one executive at a large U.S.-based consulting firm. Remarkably, these private chats revealed that these corporate executives frequently possessed detailed knowledge regarding brand-new ShinyHunters victims long before the victim organizations themselves had even discovered or acknowledged the security breaches.
Furthermore, investigators uncovered a potentially explosive finding within the Dutch hacker’s chat logs: Mr. Dubrovsky was fully aware that ShinyHunters had exfiltrated highly sensitive personnel data directly from FBI servers, yet he chose never to inform the bureau of the data breach before the hackers publicly threatened on Twitter/X to publish the agency’s confidential files.
SHINYWIRE
Investigators delving deeper into the probe believe that at least one executive at a prominent U.S.-based consulting firm played an active, operational role in managing the now-defunct ShinyHunters victim extortion web portal known as "shinywire.com." While federal investigators are continuing to build their case, media outlets have withheld naming the specific U.S. company and the suspected executives because formal criminal charges have not yet been filed, though the enterprise is recognized as a prestigious firm with a workforce exceeding 1,000 associates.
The Shinywire website remained actively operational from approximately May 3 until October 16, hosting individual extortion entries for nearly 100 organizations that had been compromised by ShinyHunters. Each entry aggressively urged victimized entities to engage with the cybercrime syndicate to negotiate payment terms. To compound the pressure, the web pages featured authentic samples of stolen corporate files, alongside explicit warnings that the full trove of data would be publicly released online if the victim failed to meet the extortion demands within a strict timeframe.
Cached internet records highlight numerous extortion listings on the site, including one targeting Intuitive Surgical, an American medical technology company that suffered a breach in March after an employee fell victim to a targeted phishing campaign. Under the established operational model of the portal, victim organizations that refused to engage or negotiate within a seven-day window found all of their confidential stolen data permanently published on the main ShinyHunters victim shaming blog, which is accessible exclusively via the Tor anonymity network.
Legal and business disputes surrounding these cybersecurity firms have added further complexity to the federal investigation. Reports indicate that a few months prior to his arrest by the FBI, Edward Dubrovsky had filed a civil lawsuit in Ontario against Daniel Tobok, the former chief executive of Cypfer, a prominent cybersecurity firm founded in Toronto with international offices spanning the U.S., Britain, the Netherlands, the United Arab Emirates, and Mexico.
The two men originally became business partners in 2017 and subsequently built Cypfer together, with Dubrovsky serving as a managing partner and chief operating officer. However, by 2024, their professional relationship had deteriorated significantly. Dubrovsky alleged in court documents that Tobok had gradually marginalized him from core business matters and executed increasingly erratic business decisions, ultimately attempting to destroy him professionally. Tobok strongly denied the allegations, filing a counterclaim accusing Dubrovsky of misappropriating confidential information and engaging in unfair competition through a separate entity known as CyberSteward Inc., while also disputing Dubrovsky’s claims to being a foundational shareholder.
GHOSTBYTE
As investigators expanded their inquiries into industry figures, former colleagues pointed toward historical digital identities associated with Tobok. Interviews revealed that as far back as eight years ago, Tobok was known among certain ransomware purveyors by the specific nickname "Ghostbyte."
In 2018, a Canadian company fell victim to a cyberattack orchestrated by Dharma, a prolific Russian-language ransomware affiliate program that emerged in 2016. When the victim company informed the Dharma ransomware representative that they were leaning toward paying the ransom because critical encrypted files were otherwise unrecoverable, they requested stronger guarantees that the cybercriminals would honor their word upon payment.
In a written response, the Dharma representative explicitly directed the victim to contact an external IT professional in Canada who could provide such assurances, recommending they reach out to the email address [email protected]. "If you want guarantees, you can write to the IT company," the Dharma operative advised the victim. "Take the phone and negotiate with them. This IT company often solves such problems in Canada. You can contact them and sign a contract for services."
While it remains formally unproven whether Tobok actively monitored or utilized that specific Ghostbyte email address, breach-tracking intelligence services have revealed that an email address frequently used by Tobok—[email protected]—was directly linked to multiple online accounts utilizing "ghostbyte" as a designated username, including a Snapchat profile. Furthermore, cybersecurity intelligence data connects the Dharma representative’s email address to a cryptocurrency wallet that processed dozens of high-value bitcoin transactions totaling millions of dollars.
Representatives for Cypfer issued statements emphasizing that the company’s official business model does not include making or facilitating ransomware payments, and noted that leadership only learned of Dubrovsky’s arrest through media reports. Cypfer stressed that it had received no outreach from law enforcement and was not the target of any active government investigation. The statement further clarified that CyberSteward and Cypfer operate as entirely separate entities with no shared officers, directors, or employees, noting that Cypfer was recently acquired by the Apros Group, a holding company led by former FBI special agent Jason Hogg.
CONFLICTING INTERESTS
Within the United States, paying a ransom to acquire decryption keys or secure a promise from cybercriminals to delete stolen data is not inherently illegal. Legal complications typically arise only if a victim organization makes payments to a terrorist organization or a cybercrime syndicate explicitly placed on the sanctions list maintained by the U.S. Treasury Department. Notably, ShinyHunters has not been designated as a sanctioned entity by the United States government or any international coalition.
Industry experts note that corporate victims are frequently guided by their cyber insurance providers to collaborate with specialized incident response and forensic firms. However, philosophical approaches vary widely across the sector. While some reputable firms refuse to facilitate ransom payments under any circumstances, others maintain no such ethical or professional restrictions. Consequently, when victim firms become determined to pay ransom demands, principled incident response providers are frequently dismissed and replaced by firms willing to execute the transactions.
This dynamic played out prominently during the late 2024 extortion campaign against PowerSchool, an educational technology company that suffered a massive data breach compromising the private information of tens of millions of students and teachers across the United States and Canada. Although PowerSchool reportedly paid a multi-million-dollar ransom facilitated by CyberSteward, the payment failed to prevent subsequent waves of extortion targeting individual school districts using the exact same stolen records. This incident underscored a fundamental reality recognized by federal authorities: there is no technical mechanism to ensure threat actors have truly deleted stolen data as promised, nor any way to stop malicious actors from repeatedly abusing compromised repositories.
Leading cyber incident response firms, including Coveware and Unit 221B, have consistently advised corporate clients against paying ransoms to groups like ShinyHunters, publicly warning that supposedly "destroyed" victim data is routinely retained, resold, or weaponized to directly extort downstream clients. These warnings have drawn intense ire from the hackers themselves. Internal communications recovered by investigators show that the main ShinyHunters Telegram account frequently complained to co-conspirators that Coveware was actively harming their business model and lowering their overall corporate payment success rates, even discussing plans to "eliminate the problem."
Industry leaders point out that financial structures within the ransomware remediation market create inherent conflicts of interest. Mark Camillo, chief executive of CyberAcuView—an industry consortium founded by major cyber insurance carriers—noted that while some firms charge flat professional retainers, many specialized negotiation firms collect a variable fee calculated as a percentage of the total ransom paid.
This compensation model grants negotiators a direct financial incentive to encourage higher payouts and refrain from aggressively negotiating down the extortion price. Camillo emphasized that the broader cybersecurity ecosystem must establish greater transparency and visibility regarding cryptocurrency transactions and exchange fees to eliminate misaligned financial incentives.
Recent enforcement actions by the U.S. Department of Justice highlight the growing regulatory crackdown on compromised intermediaries within the cyber extortion market. Federal prosecutors have indicted and sentenced multiple ransomware negotiators and executives for wire fraud and conspiracy, detailing schemes where individuals secretly went behind their clients’ backs to funnel millions of dollars to ransomware syndicates while exaggerating remediation costs and enabling criminals to maximize their illicit profits.
Basiran 
Reynand Wu