Federal Investigators Probe Ransomware Negotiation Firms Over Close Ties to ShinyHunters Hacking Group

U.S. federal investigators pursuing the notorious ShinyHunters hacking group—which recently compromised highly sensitive data belonging to the Federal Bureau of Investigation—have turned their focus toward senior figures within the cybersecurity industry. According to sources close to the ongoing investigation, authorities have identified executives at two different ransomware negotiation and remediation firms who maintained unusually close and illicit relations with the cyber extortion syndicate. Investigators revealed that one of these U.S.-based executives allegedly went so far as to help ShinyHunters operate a dedicated pressure website designed to coerce breach victims into paying ransom demands.

Hackers operating under the ShinyHunters banner have claimed responsibility for dozens of major data breaches since 2019. During its initial years, the collective was primarily managed by cybercriminals based in France. However, as law enforcement systematically tracked down, arrested, and jailed those early members, operational control of the ShinyHunters brand eventually shifted to "Rey." Identified by security researchers last year, Rey is a teenage hacker operating out of Amman, Jordan. According to estimates provided by the FBI, the rejuvenated group has successfully extorted more than $70 million from corporate and institutional victims over the course of the year.

The group’s audacity reached a peak in late September when ShinyHunters successfully breached the FBI recruitment portal, fbijobs.gov. To mock federal authorities, the hackers threatened to publicly release a trove of stolen files. Reports indicated that the pilfered data included deep personal details such as medical and psychological records, Social Security numbers, home addresses, and specific information detailing the operational units and specializations of bureau employees.

The brazen breach of a core federal law enforcement recruitment site prompted the FBI to respond with uncommon speed, moving aggressively to detain and question individuals who maintained any communication channels with Rey or other key ShinyHunters suspects. On October 3, Reuters reported that Rey had been detained by Jordanian authorities and was actively cooperating with federal investigators.

Rey’s rise to administrative control over the hacking group was made possible by the sudden removal of one of its senior operatives. On the evening of September 15, law enforcement officers in the Netherlands executed a high-stakes raid, arresting convicted hacker and primary ShinyHunters suspect Pepijn van der Stap. Dutch police reportedly deployed flash-bang grenades to stun and apprehend Van der Stap while he remained actively logged into multiple online accounts.

According to sources close to the investigation, the timing of the raid allowed authorities to seize Van der Stap while he was actively using his Signal instant messaging account. This immediate access provided investigators with a real-time window into his recent communications, revealing a network of frequent contacts that included professional ransomware negotiators based in both Canada and the United States.

Multiple knowledgeable sources indicated that Van der Stap’s decrypted Signal messages became the crucial piece of evidence needed to unravel a disturbing murder-for-hire plot that surfaced immediately following his apprehension. Last month, Dutch news outlet RTL reported that two murders were allegedly planned to be carried out abroad, with strong indications pointing to Van der Stap as the individual who issued the orders, though authorities noted there is no evidence the planned attacks were ever executed.

The digital trail soon led directly to the executive suite. On October 9, KrebsOnSecurity broke the news that the FBI had arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the escalating ShinyHunters investigation. Dubrovsky, who recently authored a book on handling cyber extortion that explicitly recommended always engaging with hackers, was formally charged with threatening to disclose stolen data and interfering with interstate commerce through extortion, according to federal court records. Reporting from Politico noted that federal prosecutors requested Dubrovsky remain in custody pending trial, and court records associated with his case were placed under seal.

Sources close to the investigation revealed that Van der Stap’s recovered Signal conversations demonstrated frequent, direct communications between the Dutch hacker, Dubrovsky, and at least one executive at a major U.S.-based consulting firm. Troublingly, these communications showed that the executives frequently possessed detailed knowledge of newly targeted ShinyHunters victims before the victim organizations themselves even realized they had been breached.

Even more explosive was the discovery that Dubrovsky allegedly knew that ShinyHunters had successfully stolen highly sensitive data from FBI servers. Investigators found no record that Dubrovsky ever notified the bureau of the breach prior to the hackers publicly taunting the agency on social media with threats to publish deeply personal personnel records.

SHINYWIRE

As the probe widened, federal investigators uncovered evidence suggesting that at least one executive at a prominent U.S.-based consulting firm played an active, operational role in managing the now-defunct ShinyHunters extortion platform known as "shinywire[.]com." While KrebsOnSecurity has chosen to withhold the names of the U.S. company and the suspected executive pending formal criminal charges, the firm in question is an established organization employing more than 1,000 associates.

The Shinywire portal operated from approximately May 3 until October 16, cataloging nearly 100 organizations that had fallen victim to ShinyHunters intrusions. Each entry on the site pressured targeted entities to initiate discussions with the cybercrime syndicate regarding payment terms. The pages featured samples of stolen files and explicitly promised that the full cache of data would be published openly if the victim failed to meet the extortion demands within a set timeframe.

Cached portions of the site indexed by security services highlighted extortion demands directed at high-profile entities, such as Intuitive Surgical, an American medical technology company that suffered a breach in March after an employee fell victim to a targeted phishing email. Under the operational mechanics of the site, victim organizations that refused to engage or negotiate within a seven-day window found their stolen data permanently published on the ShinyHunters shaming blog, which remained accessible only via the Tor anonymity network.

The widening fallout also touched upon pre-existing corporate disputes within the cybersecurity sector. In mid-October, The Globe and Mail reported that months prior to his arrest, Dubrovsky had filed a lawsuit in Ontario alleging he had become collateral damage in a deliberate campaign by a former business partner seeking to destroy another industry executive. Dubrovsky’s legal filings targeted Daniel Tobok, the former chief executive of Cypfer, a Toronto-founded cybersecurity firm with an international footprint spanning the United States, Britain, the Netherlands, the United Arab Emirates, and Mexico.

Dubrovsky and Tobok initially became business partners in 2017, later building Cypfer together where Dubrovsky served as managing partner and chief operating officer. However, by 2024, the partnership had fractured. Dubrovsky accused Tobok of gradually freezing him out of core business operations and making increasingly erratic decisions. Tobok denied the allegations and filed a counterclaim accusing Dubrovsky of misappropriating confidential information and competing unfairly through an entity called CyberSteward Inc., while disputing Dubrovsky’s claim to being a company founder or shareholder.

GHOSTBYTE

Interviews with former colleagues of Daniel Tobok revealed that years prior to these corporate clashes, he had been known within ransomware circles by a specific moniker: Ghostbyte. In 2018, a Canadian enterprise was targeted by Dharma, a prolific Russian-language ransomware affiliate program active since 2016. When the victim company expressed willingness to pay to recover locked files but demanded guarantees that the hackers would honor their word, the Dharma representative pointed them toward a Canadian IT professional.

A redacted copy of the correspondence showed the Dharma representative advising the victim to contact an email address associated with the handle "[email protected]." The ransomware operator told the victim that this particular IT company frequently resolved similar extortion scenarios in Canada under a formal service contract.

While it remains unconfirmed whether Tobok actively utilized the Ghostbyte email address provided by the Dharma affiliate, background checks conducted by breach tracking service Constella Intelligence revealed that an email address frequently used by Tobok—[email protected]—was linked to online accounts utilizing the username "ghostbyte," including a Snapchat profile. Furthermore, Constella connected the Dharma representative’s email address to a cryptocurrency wallet that had processed numerous high-value transactions.

In response to inquiries, Cypfer issued a statement clarifying that its core business operations do not involve facilitating ransomware payments. The company stated that it learned of Dubrovsky’s arrest through media reports, maintained no prior knowledge of the federal action, and had received no outreach from law enforcement regarding any investigation. Cypfer added that it operates entirely independently from CyberSteward, sharing no officers, directors, or common employees, and noted that it was recently acquired by the Apros Group, a holding company led by former FBI special agent Jason Hogg.

CONFLICTING INTERESTS

The broader landscape of cyber extortion reveals a complex ecosystem where the boundaries between defense, remediation, and extortion often blur. While paying ransoms to retrieve encryption keys or secure promises of data deletion is not inherently illegal under U.S. law—provided the targeted group is not subject to U.S. Treasury Department sanctions—investigators and industry watchdogs have increasingly scrutinized the financial incentives driving incident response firms.

Victim organizations typically rely on cyber insurance carriers to direct them toward approved incident response providers. However, because some forensics firms refuse to facilitate ransom payments on ethical grounds, clients frequently pivot to negotiators who harbor no such reservations. This dynamic often places negotiators in a position of severe conflict of interest, particularly when their compensation is tied directly to a percentage of the final ransom payout rather than a flat fee.

Industry leaders have pointed out that percentage-based models create a perverse financial incentive to inflate ransom demands or discourage pushback against threat actors. The U.S. Department of Justice has pursued multiple high-profile cases targeting fraudulent remediation practices. In October, federal prosecutors charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy for allegedly charging clients millions for remediation while secretly paying hackers behind their backs. Similarly, in July, a Florida-based ransomware negotiator was sentenced to prison for conspiring with the BlackCat/ALPHV group to leak confidential client negotiation strategies and maximize extortion payouts.

As federal investigations continue into the operations of ShinyHunters, the intersection of corporate consulting, ransomware negotiation, and underground cybercrime remains under intense scrutiny by law enforcement agencies worldwide.