{"id":2110,"date":"2026-10-19T14:04:18","date_gmt":"2026-10-19T14:04:18","guid":{"rendered":"https:\/\/smartcryptosecurity.com\/?p=2110"},"modified":"2026-10-19T14:04:18","modified_gmt":"2026-10-19T14:04:18","slug":"federal-investigators-uncover-deep-ties-between-ransomware-negotiation-executives-and-the-shinyhunters-hacking-group","status":"publish","type":"post","link":"https:\/\/smartcryptosecurity.com\/?p=2110","title":{"rendered":"Federal Investigators Uncover Deep Ties Between Ransomware Negotiation Executives and the ShinyHunters Hacking Group"},"content":{"rendered":"

U.S. federal investigators pursuing the notorious ShinyHunters hacking group, which recently pulled off a high-profile breach stealing sensitive data from the Federal Bureau of Investigation, have identified executives at two separate ransomware negotiation firms who maintained unusually close and illicit relations with the extortion syndicate. According to sources close to the unfolding investigation, one of these executives based in the United States actively helped ShinyHunters operate a dedicated pressure website designed to coerce victims into paying multi-million-dollar ransoms.<\/p>\n

Hackers aligned with the ShinyHunters brand have claimed responsibility for dozens of major corporate and institutional data breaches since 2019. In its early days, the group was primarily operated by cybercriminals residing in France. However, as those original members were systematically arrested, indicted, and jailed by international law enforcement, operational control over the ShinyHunters banner eventually shifted to "Rey," an alias identified last year as a teenage hacker operating out of Amman, Jordan. According to official estimates from the FBI, the syndicate has successfully extorted more than $70 million from corporate and public sector victims so far this year alone.<\/p>\n

The group’s brazen activities escalated dramatically in late September when ShinyHunters compromised the FBI recruitment website, fbijobs.gov. The attackers taunted federal law enforcement by threatening to publish stolen internal files, which reportedly included deeply sensitive employee records such as medical and psychological evaluations, Social Security numbers, home addresses, and detailed specifications regarding individual employee units and specializations.<\/p>\n

The breach of the Bureau’s jobs portal prompted the agency to move with uncommon speed, tracking down, detaining, and interrogating individuals who had maintained any communications with Rey or other suspects linked to the ShinyHunters network. On October 3, Reuters reported that Rey had been apprehended by Jordanian authorities and was actively cooperating with the FBI.<\/p>\n

Rey had managed to assume broader control over the hacking group because one of its alleged senior figures had just been neutralized. On the evening of September 15, police in the Netherlands executed a high-stakes raid, arresting convicted hacker and primary ShinyHunters suspect Pepijn van der Stap. Dutch law enforcement reportedly deployed flash-bang grenades in an effort to stun and apprehend Van der Stap precisely while he remained actively logged into various online accounts.<\/p>\n

According to a source close to the investigation, authorities arrested Van der Stap while he was actively using his Signal instant messaging account. This tactical advantage allowed investigators to immediately review recent communications with frequent contacts, which included prominent ransomware negotiators based in both Canada and the United States. <\/p>\n

\"Feds<\/figure>\n

Multiple sources with direct knowledge of the matter revealed to KrebsOnSecurity that Van der Stap\u2019s recovered Signal messages provided the critical evidence necessary to unravel a separate, sinister murder-for-hire plot that surfaced immediately following his arrest. Dutch news outlet RTL reported last month that two murders were allegedly planned to be carried out abroad, with investigators finding strong indications that Van der Stap had issued the orders for the planned attacks, though there is no evidence indicating those violent plots were ever actually carried out.<\/p>\n

Building upon the digital evidence, federal authorities moved swiftly on October 9, when the FBI arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the broadening ShinyHunters probe. Dubrovsky, who had recently authored a published book on handling cyber extortion that strongly recommended always engaging with malicious hackers, was formally charged in court records with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion. Politico reported that federal prosecutors requested Dubrovsky remain in custody pending trial, with court records related to the case kept under strict seal.<\/p>\n

A source close to the investigation shared that Van der Stap\u2019s Signal message archives demonstrated frequent, direct conversations between the Dutch hacker, Dubrovsky, and at least one executive at a large U.S.-based consulting firm. Troublingly, these communications revealed that the executives often possessed intimate details regarding new ShinyHunters data breaches before the victim organizations themselves had even discovered they had been compromised.<\/p>\n

Furthermore, investigators uncovered what they consider a potentially explosive finding: the Dutch hacker\u2019s chat logs showed that Dubrovsky was fully aware that ShinyHunters had exfiltrated highly sensitive personnel data directly from core FBI servers, yet he never notified the Bureau of the massive breach prior to ShinyHunters publicly announcing the hack and threatening to publish the files on social media platforms like X.<\/p>\n

SHINYWIRE<\/p>\n

As the probe deepened, KrebsOnSecurity learned from two separate sources close to the investigation that FBI agents strongly believe at least one executive at a prominent U.S.-based consulting firm played an active, operational role in managing the now-defunct ShinyHunters victim extortion portal, known as "shinywire.com." While federal investigators continue their work, KrebsOnSecurity has withheld the name of the U.S. company and the suspected executive or executives because formal criminal charges have not yet been filed, though the firm in question is an established organization with more than 1,000 professional associates.<\/p>\n

The Shinywire web domain remained active from approximately May 3 until October 16, featuring listings for nearly 100 corporate and institutional organizations successfully compromised by ShinyHunters. Each entry on the portal urged victim entities to directly engage with the cybercrime collective to discuss financial terms for non-disclosure. The pages strategically included verified samples of stolen data, promising complete public leaks if the victimized companies ignored the extortion demands.<\/p>\n

\"Feds<\/figure>\n

Victim organizations that refused to communicate or negotiate within a strict seven-day window routinely found their stolen proprietary files published on the primary ShinyHunters victim shaming blog, a dark web site accessible solely via the Tor anonymity network.<\/p>\n

The web of corporate conflicts and legal fallout deepened in mid-October when The Globe and Mail reported that months prior to his arrest by the FBI, Edward Dubrovsky had filed a civil lawsuit in Ontario alleging he had become collateral damage in a personal vendetta by a former business partner aiming to destroy another industry executive. Dubrovsky\u2019s lawsuit targeted Daniel Tobok, the former chief executive of Cypfer, an international cybersecurity firm founded in Toronto with branch offices spanning the United States, Britain, the Netherlands, the United Arab Emirates, and Mexico. <\/p>\n

Having initially become business partners in 2017 to build Cypfer\u2014where Dubrovsky served as managing partner and chief operating officer\u2014the two men experienced a severe falling out by 2024. Dubrovsky accused Tobok of gradually freezing him out of core business decisions and making increasingly capricious choices. Tobok countered the allegations through legal filings, denying wrongdoing and launching a counterclaim accusing Dubrovsky of misappropriating confidential corporate information and unfairly competing with Cypfer through alternate advisory work at a separate entity named CyberSteward Inc., while also alleging Dubrovsky falsely represented himself as a foundational founder rather than an equity shareholder.<\/p>\n

GHOSTBYTE<\/p>\n

Interviews with several former colleagues of Daniel Tobok revealed that as far back as eight years ago, he was recognized among certain ransomware purveyors by a specific digital moniker: "Ghostbyte." In 2018, a Canadian company fell victim to a cyberattack orchestrated by Dharma, a prolific Russian-language ransomware affiliate program that first emerged in 2016. When the victim company informed the Dharma ransomware representative that they were leaning toward paying the ransom because critical encrypted files were unrecoverable, they requested stronger guarantees that the extortionists would honor their word.<\/p>\n

In a written reply from the Dharma representative, the cybercriminals explicitly advised the victim to reach out to an IT company in Canada that routinely handled such arrangements, directing them to contact the email address ghostbyte@tutanota.com. The Dharma operative noted that the specialized IT firm frequently solved such extortion dilemmas in Canada, instructing the victim to establish a formal service contract to facilitate the payout.<\/p>\n

While it remains unclear whether Tobok ever actively utilized the specific Ghostbyte address referenced in the Dharma correspondence, and despite Tobok failing to respond to multiple requests for comment, digital footprint analysis from the breach tracking service Constella Intelligence indicates a direct connection. According to Constella, an email address frequently used by Tobok\u2014dtobok@me.com\u2014was tied to multiple online accounts utilizing the exact username "ghostbyte," including a registered Snapchat profile. <\/p>\n

\"Feds<\/figure>\n

Furthermore, Constella’s intelligence tracking identified that the Dharma representative’s email address, luckygoodlucky@tuta.io, linked directly to a specific cryptocurrency wallet address that processed 38 distinct transactions totaling roughly 43 bitcoin, valued at approximately $3.5 million at contemporary rates, with the most recent wallet activity dated February 2019.<\/p>\n

Cypfer issued an official statement maintaining that its business operations do not encompass making or facilitating ransomware payments, noting that the company only learned of Dubrovsky’s federal arrest when public news reports broke. Emphasizing that Cypfer had received no outreach from law enforcement and was not the target of any ongoing investigation, the company clarified that CyberSteward and Cypfer operate as entirely separate entities with no shared officers, directors, or employees. Cypfer was recently acquired by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. Aon had previously acquired Cytelligence in 2020, a security consulting firm where Tobok served as founder and CEO and Dubrovsky functioned as managing partner.<\/p>\n

CONFLICTING INTERESTS<\/p>\n

Under U.S. law, it is not inherently illegal to pay hackers for decryption keys to unlock operational servers or to secure promises that stolen proprietary data will be permanently deleted and withheld from public exposure. However, victim organizations face severe legal jeopardy if they disburse ransom payments to criminal collectives currently designated as sanctioned entities by the U.S. Treasury Department, though ShinyHunters has not been placed on formal government sanction lists.<\/p>\n

Industry experts note that corporate victims are frequently guided by their cyber insurance providers to collaborate with specialized incident response and negotiation firms. However, because not all forensic firms are willing to facilitate extortion payments on behalf of clients, victims frequently replace principled firms that refuse to reward cybercriminals with negotiation providers willing to execute payouts.<\/p>\n

The systemic dangers of these arrangements were highlighted in December 2024, when ShinyHunters targeted education technology provider PowerSchool, exfiltrating private data belonging to 62 million students and 9.5 million teachers across the United States and Canada. PowerSchool reportedly disbursed a $2.85 million ransom demand, assisted in the negotiation process by CyberSteward. Despite the payout, the relief was temporary; by May 2025, individual school districts began receiving independent ransom demands utilizing samples of the identical stolen files. While no agency formally accused ShinyHunters of orchestrating the secondary wave of extortion, the incident underscored a fundamental reality of modern cybercrime: there is no technical mechanism to verify that threat actors have truly purged stolen data, nor any way to prevent malicious actors from repeatedly abusing compromised records.<\/p>\n

Leading cyber incident response firms, including Coveware and Unit 221B, have consistently warned corporate victims against paying the ShinyHunters syndicate, pointing out that purportedly destroyed victim data is frequently retained, resold, or leveraged directly against a company’s downstream clients. The FBI reinforced this guidance through an official advisory issued on May 15, warning victims against yielding to ShinyHunters’ extortion demands. In response, members of the hacking syndicate have actively harassed and threatened security professionals at Coveware and Unit 221B for providing such risk-mitigation advice.<\/p>\n

\"Feds<\/figure>\n

Internal communications reviewed by federal investigators illustrate the profound frustration expressed by ShinyHunters leadership regarding Coveware’s public stance. In private Telegram chats from May and April 2026, the primary ShinyHunters account complained bitterly to co-conspirators that Coveware was actively damaging their payment rates by counseling victims against negotiating. The operators lamented that the vast majority of targeted companies would have readily paid had it not been for the external misinformation and intervention, noting that they were actively seeking ways to eliminate the perceived obstacle posed by the response firm.<\/p>\n

Coveware CEO Bill Siegel declined to comment on matters concerning past clients or the ShinyHunters group, noting only that federal law enforcement had formally notified affected victims regarding Van der Stap’s alleged murder-for-hire scheme, while confirming that no Coveware personnel had received such warnings.<\/p>\n

Mark Camillo, chief executive of CyberAcuView\u2014an industry consortium established in 2021 by major cyber insurance carriers\u2014pointed out that fee structures within the incident response sector often generate profound conflicts of interest. While some firms charge straightforward flat retainers, others specializing in ransom negotiations typically collect a percentage-based commission tied directly to the total ransom payout. Camillo argued that this financial model creates an inherent perverse incentive, encouraging negotiators to favor a payout and maximize transaction volumes rather than aggressively driving down ransom demands.<\/p>\n

Recent actions by the U.S. Department of Justice highlight a broader regulatory crack-down on fraudulent negotiation practices. On October 7, federal prosecutors charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy for allegedly billing clients exorbitant remediation fees to resolve ransomware attacks without paying hackers, while secretly funneling $8 million to cybercriminals behind their clients’ backs. Similarly, in July, Florida-based ransomware negotiator Angelo Martino was sentenced to 70 months in federal prison for conspiring with the Blackcat\/ALPHV ransomware group to extort victims by feeding confidential negotiation strategies directly to the threat actors to maximize extortion yields.<\/p>\n","protected":false},"excerpt":{"rendered":"

U.S. federal investigators pursuing the notorious ShinyHunters hacking group, which recently pulled off a high-profile…<\/p>\n","protected":false},"author":16,"featured_media":2109,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[198],"tags":[1796,146,1798,370,176,144,1794,1797,184,337,205,169,204,1625,1795],"class_list":["post-2110","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-phishing-social-engineering","tag-deep","tag-defense","tag-executives","tag-federal","tag-group","tag-hacking","tag-investigators","tag-negotiation","tag-phishing","tag-ransomware","tag-security-awareness","tag-shinyhunters","tag-social-engineering","tag-ties","tag-uncover"],"_links":{"self":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/2110","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/users\/16"}],"replies":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2110"}],"version-history":[{"count":0,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/2110\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/media\/2109"}],"wp:attachment":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2110"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2110"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2110"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}