By rifanmuazin 
U.S. federal investigators probing the notorious ShinyHunters hacking group—which recently executed a high-profile breach of the FBI—have uncovered an alarming web of collusion within the cybersecurity industry. According to sources close to the investigation, authorities have identified executives at two separate ransomware negotiation firms who maintained unusually close and illicit relations with the extortion syndicate. In an escalation of the case, investigators claim that one of these U.S.-based executives actively assisted ShinyHunters in operating a dedicated website designed to pressure breach victims into paying steep ransom demands.
The ShinyHunters brand has been tied to dozens of major corporate and institutional data breaches since 2019. Originally operated by cybercriminals based in France, the collective evolved as its founding members were systematically arrested and jailed by international law enforcement. Control over the group eventually shifted to a teenage hacker from Amman, Jordan, known online as "Rey," who was identified by researchers last year. According to estimates provided by the FBI, ShinyHunters has successfully extorted more than $70 million from corporate and government victims so far this year alone.
The syndicate made international headlines in late September when it successfully breached the FBI recruitment portal, fbijobs.gov. The hackers brazenly taunted the law enforcement agency by threatening to leak stolen internal files. Reports indicated that the compromised data included highly sensitive personnel records, such as psychological evaluations, medical files, Social Security numbers, home addresses, and details regarding specific employee units and specializations.
The compromise of the FBI’s jobs website triggered an immediate and aggressive response from federal authorities, who moved swiftly to detain and question anyone who had maintained communication with Rey or other suspects linked to ShinyHunters. On October 3, Reuters reported that Rey had been detained by authorities in Jordan and was actively cooperating with the FBI.
Rey’s rise to control over the hacking group followed the sudden disruption of a senior operative. On the evening of September 15, 2026, Dutch police carried out a dramatic raid, utilizing flash-bang grenades to stun and apprehend convicted hacker and ShinyHunters suspect Pepijn van der Stap as he remained logged into various online accounts. Law enforcement officials seized Van der Stap while he was actively using his Signal instant messaging account, granting investigators immediate access to recent communications with frequent contacts, including ransomware negotiators located in the United States and Canada.
According to sources familiar with the matter, Van der Stap’s decrypted Signal messages served as the crucial thread that unraveled a secondary criminal conspiracy involving an alleged murder-for-hire plot that surfaced immediately following his arrest. Dutch news outlet RTL reported last month that two murders were allegedly planned to take place abroad, with indications pointing to Van der Stap as the person who issued the directives, though there is no evidence to suggest those orders were ever successfully executed.
The digital footprint recovered from Van der Stap’s devices soon led federal agents to the doorstep of the commercial ransomware negotiation sector. On October 9, KrebsOnSecurity broke the news that the FBI had arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the ongoing ShinyHunters probe. Dubrovsky, who recently authored a book on handling cyber extortion that explicitly advised victims to always engage with hackers, was charged in U.S. federal court with threatening to disclose hacked data and interfering with interstate commerce through extortion. Prosecutors subsequently asked that Dubrovsky remain in custody pending trial, with court records remaining under seal.
Investigators analyzing Van der Stap’s Signal logs discovered that the Dutch hacker maintained a steady stream of communication with Dubrovsky as well as at least one executive at a prominent U.S.-based consulting firm. Remarkably, these messages revealed that the executives frequently possessed detailed knowledge of fresh ShinyHunters cyberattacks and data thefts before the victim organizations themselves had even discovered they had been breached. Furthermore, federal investigators uncovered evidence indicating that Dubrovsky was fully aware that ShinyHunters had exfiltrated highly sensitive personnel data from FBI servers. Despite this knowledge, he allegedly never notified the bureau prior to the hackers publicly threatening to publish the deeply personal personnel files on social media.
SHINYWIRE
As the probe widened, investigators uncovered deeper involvement by industry intermediaries. Sources close to the inquiry revealed that federal agents believe at least one executive at a major U.S. consulting firm played an active, hands-on role in operating "shinywire[.]com," a now-defunct extortion portal utilized by ShinyHunters. While the firm—a prestigious organization with over 1,000 associates—and the specific executive have not yet been formally charged, their identities are being withheld by researchers as the investigation continues.
The Shinywire website operated from early May until mid-October, cataloging nearly 100 organizations compromised by ShinyHunters. Each listing functioned as a pressure campaign, urging victim entities to open negotiations and discuss payment terms while displaying samples of stolen data to underscore the threat of public leaks. Among the documented targets was Intuitive Surgical, an American medical technology company that suffered a breach in March after an employee fell victim to a targeted phishing campaign. Under the group’s operational model, companies that refused to engage within a strict seven-day window found their stolen databases published on the syndicate’s primary shaming blog, which is accessible exclusively via the Tor anonymity network.
The fallout from the investigation has also exposed bitter internal feuds within the cybersecurity sector. In mid-October, The Globe and Mail reported that Dubrovsky had filed a lawsuit in Ontario earlier in the year against Daniel Tobok, the former chief executive of Cypfer, a prominent Toronto-founded cyber firm with international offices. Dubrovsky alleged that he had become collateral damage in a deliberate campaign by his former business partner to destroy his professional reputation following a falling-out over management decisions. Tobok denied the allegations and filed a counterclaim, accusing Dubrovsky of misappropriating confidential information and engaging in unfair competition through another venture called CyberSteward Inc.
GHOSTBYTE
The investigation into industry figures has also drawn scrutiny toward historical digital monikers. According to interviews with former colleagues, Tobok was known among ransomware actors years ago by the alias "Ghostbyte." In 2018, a Canadian company targeted by the Dharma ransomware affiliate program sought assurances that the attackers would honor an agreement to decrypt locked files in exchange for a payment. In email correspondence reviewed by investigators, a Dharma representative advised the victim to contact an IT professional using the email address [email protected], noting that the individual frequently resolved similar extortion scenarios in Canada.
While it remains unclear whether Tobok actively utilized the Ghostbyte address, breach intelligence service Constella Intelligence found that an email address frequently used by Tobok was linked to online accounts operating under the username "ghostbyte." Additionally, blockchain analysis connected the Dharma representative’s fallback email address to a cryptocurrency wallet that processed significant funds during that period.
Cypfer issued a statement clarifying that its business operations do not involve facilitating ransomware payments and asserting that the company had no prior knowledge of Dubrovsky’s arrest. The firm emphasized that it has not been contacted by law enforcement and is not the subject of any active investigation. Cypfer was recently acquired by the Apros Group, a holding company led by former FBI special agent Jason Hogg. Aon previously acquired Cytelligence, a security consultancy where Tobok served as CEO and Dubrovsky as a managing partner.
CONFLICTING INTERESTS
Under U.S. law, paying a ransom to recover encrypted systems or secure promises of data deletion is not inherently illegal, provided the ransomware group is not subject to U.S. Treasury Department sanctions—a designation that does not currently apply to ShinyHunters. However, the ecosystem surrounding incident response and ransom negotiation has long faced scrutiny over potential conflicts of interest. Insurance providers frequently direct breach victims to specific remediation firms, but because some security companies refuse to facilitate payments, clients often gravitate toward intermediaries willing to negotiate with extortionists.
The financial structures of certain negotiation firms have increasingly drawn the ire of law enforcement and industry watchdogs. Mark Camillo, chief executive of cyber insurance industry group CyberAcuView, noted that firms charging a percentage of the total ransom payment rather than a flat fee introduce an inherent conflict of interest. This fee structure provides negotiators with a financial incentive to encourage payouts and discourages aggressive pushback against inflated ransom demands.
The U.S. Department of Justice has ramped up enforcement actions against intermediaries accused of defrauding clients. In October, federal prosecutors charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy, alleging that he billed clients millions for remediation while secretly paying hackers behind their backs. Similarly, in July, a Florida-based ransomware negotiator was sentenced to prison for conspiring with the Blackcat/ALPHV syndicate to provide confidential client negotiating strategies, enabling attackers to maximize their extortion payouts. As federal investigations continue into the nexus between consulting executives and syndicates like ShinyHunters, scrutiny over the transparency and ethics of the ransomware negotiation industry is expected to intensify.
Nana Muazin 
Ali Ikhwan 
Basiran