{"id":2180,"date":"2026-10-20T06:04:15","date_gmt":"2026-10-20T06:04:15","guid":{"rendered":"https:\/\/smartcryptosecurity.com\/?p=2180"},"modified":"2026-10-20T06:04:15","modified_gmt":"2026-10-20T06:04:15","slug":"feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site-krebs-on-security","status":"publish","type":"post","link":"https:\/\/smartcryptosecurity.com\/?p=2180","title":{"rendered":"Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site \u2013 Krebs on Security"},"content":{"rendered":"

The sprawling federal probe underscores an increasingly murky underworld where the boundaries between cyber defense professionals, ransom negotiators, and the malicious actors themselves have begun to blur. <\/p>\n

Hackers aligned with ShinyHunters have claimed responsibility for dozens of major corporate and institutional data breaches since 2019. Originally operated primarily by cybercriminals based in France, the group underwent a leadership transition as French authorities systematically arrested or jailed its founding members. Control over the ShinyHunters brand eventually passed to an administrator known as "Rey," who was identified by researchers last year as a teenage hacker residing in Amman, Jordan. According to estimates provided by the FBI, the syndicate has successfully extorted more than $70 million from victims this year alone.<\/p>\n

The group’s brazen operations reached a critical inflection point in late September, when ShinyHunters compromised the FBI recruitment website, fbijobs.gov. To mock the federal law enforcement agency, the hackers threatened to publish a trove of stolen internal files. Reports indicate the compromised data included sensitive medical and psychological records, Social Security numbers, home addresses, and detailed information regarding the individual specializations and units of bureau employees.<\/p>\n

The breach of the FBI jobs portal spurred the bureau into swift action, resulting in the rapid detention and questioning of individuals suspected of communicating with Rey or other key members of the syndicate. On October 3, Reuters reported that Rey had been detained by authorities in Jordan and was actively cooperating with federal investigators.<\/p>\n

\"Feds<\/figure>\n

Rey\u2019s consolidation of power over the hacking group had followed closely on the heels of another high-profile law enforcement breakthrough. On the evening of September 15, law enforcement officers in the Netherlands executed a dramatic raid to arrest convicted hacker and ShinyHunters suspect Pepijn van der Stap. Dutch police reportedly deployed flash-bang grenades to stun and apprehend Van der Stap while he remained logged into various active online accounts.<\/p>\n

According to a source close to the investigation, the raid caught Van der Stap actively using his Signal instant messaging application, granting authorities immediate access to his recent communications. These digital footprints revealed frequent correspondence with ransomware negotiators located in Canada and the United States. <\/p>\n

Multiple sources with direct knowledge of the matter indicated to KrebsOnSecurity that Van der Stap\u2019s decrypted Signal messages were pivotal in unraveling a separate murder-for-hire plot that surfaced immediately following his arrest. Dutch news outlet RTL reported last month that two murders were allegedly planned to be carried out abroad, with indications pointing to Van der Stap as the individual who issued the orders, though law enforcement officials emphasize there is no evidence those plots were ever executed.<\/p>\n

The widening dragnet soon claimed prominent figures in the cybersecurity industry. On October 9, federal authorities arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the ShinyHunters investigation. Dubrovsky, who recently authored a book on handling cyber extortion that explicitly advised victims to always engage with hackers, was charged in U.S. court records with threatening to disclose hacked or stolen data and interfering with interstate commerce through extortion. Politico reported that prosecutors requested Dubrovsky remain in federal custody pending trial and that court records related to the case be placed under seal.<\/p>\n

Investigators analyzing Van der Stap’s recovered Signal messages discovered that the Dutch hacker maintained routine, direct conversations with Dubrovsky as well as at least one executive at a prominent U.S.-based consulting firm. Troublingly, these communications revealed that the executives frequently possessed detailed knowledge regarding new ShinyHunters victims even before the targeted organizations themselves had discovered they were breached.<\/p>\n

\"Feds<\/figure>\n

Furthermore, federal investigators uncovered evidence that Dubrovsky was aware ShinyHunters had successfully stolen highly sensitive data from FBI servers. Despite this knowledge, Dubrovsky reportedly never informed the bureau of the breach prior to the syndicate publicly threatening to release the agency’s confidential personnel files on social media.<\/p>\n

SHINYWIRE<\/h2>\n

As the probe expanded, investigators turned their attention to an infrastructure component dubbed "shinywire[.]com," a now-defunct extortion portal utilized by the hackers. Sources close to the investigation revealed that federal authorities believe at least one executive at a major U.S. consulting firm played an active operational role in running the website. While investigators have identified the firm\u2014a prestigious organization with more than 1,000 associates\u2014media outlets are withholding the names of the company and the suspected executives pending formal criminal charges.<\/p>\n

The Shinywire portal remained active from approximately May 3, 2026, until October 16, hosting profiles for nearly 100 organizations compromised by ShinyHunters. Each listing pressured victims to open a dialogue with the cybercrime syndicate to negotiate payment terms, supplementing the demands with samples of stolen files and explicit threats that the data would be published publicly if the organization failed to comply.<\/p>\n

Cached records from monitoring services such as urlscan.io highlighted extortion profiles targeting major entities, including Intuitive Surgical, an American medical technology firm that suffered a breach in March 2026 after an employee fell victim to a targeted phishing campaign. Victims who refused to engage with the criminals within a strict seven-day window typically found their stolen data dumped onto the ShinyHunters victim-shaming blog, which is accessible exclusively via the Tor anonymity network.<\/p>\n

The legal fallout surrounding the case has also exposed bitter corporate disputes within the industry. In mid-October, reports surfaced detailing a lawsuit filed in Ontario by Edward Dubrovsky against Daniel Tobok, the former chief executive of Cypfer, a prominent cybersecurity firm founded in Toronto with international offices. Dubrovsky alleged that he had become collateral damage in a campaign by his former business partner to destroy him following a falling out over business decisions. Tobok denied the allegations, filing a counterclaim accusing Dubrovsky of misappropriating confidential information and competing unfairly through another entity known as CyberSteward Inc.<\/p>\n

\"Feds<\/figure>\n

GHOSTBYTE<\/h2>\n

Internal industry dynamics and historical records have added further complexity to the federal inquiry. Interviews with former colleagues of Daniel Tobok indicate that years ago, the executive was known within ransomware circles by the alias "Ghostbyte." <\/p>\n

In 2018, a Canadian company targeted by Dharma\u2014a prolific Russian-language ransomware affiliate program operating since 2016\u2014reported that some of its encrypted files were unrecoverable, leading victim representatives to consider paying the ransom. However, the company sought reassurance that the cybercriminals would honor their word. In an email exchange, a Dharma representative advised the victim to contact an IT company in Canada capable of providing such guarantees, specifically recommending the email address ghostbyte@tutanota.com.<\/p>\n

While it remains unclear whether Tobok personally utilized the Ghostbyte address, breach-tracking services including Constella Intelligence indicate that an email address frequently used by Tobok\u2014dtobok@me.com\u2014was linked to online accounts using the username "ghostbyte," including a Snapchat profile. Additionally, Constella tied the Dharma representative’s email address to a cryptocurrency wallet that processed dozens of transactions worth millions of dollars.<\/p>\n

Cypfer issued a public statement clarifying that its business operations do not involve making or facilitating ransomware payments, noting that the firm only learned of Dubrovsky’s arrest through media reports. The company emphasized that it has received no outreach from law enforcement and is not the subject of any active investigation. Cypfer was recently acquired by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. Aon previously acquired Cytelligence, a security firm where Tobok served as founder and CEO and Dubrovsky operated as a managing partner.<\/p>\n

CONFLICTING INTERESTS<\/h2>\n

Under U.S. law, paying a ransom to recover encrypted systems or secure a promise to delete stolen files is not inherently illegal, provided the ransomware group is not designated as a terrorist organization or subject to Treasury Department sanctions. ShinyHunters currently holds no such official sanctions. <\/p>\n

\"Feds<\/figure>\n

Nevertheless, the ecosystem surrounding incident response and negotiation remains fraught with ethical hazards and structural conflicts of interest. Insurance providers frequently direct ransomware victims to specific cybersecurity firms to handle breach negotiations. While some firms operate on flat retainer fees, others charge a percentage of the total ransom paid. Industry experts point out that percentage-based compensation creates a perverse incentive for negotiators to inflate payouts and discourage aggressive pushback against threat actors.<\/p>\n

Recent federal prosecutions have brought these systemic vulnerabilities to light. In October, the Department of Justice charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy, alleging he charged clients millions for remediation while secretly paying hackers behind their backs. Similarly, in July, a Florida-based ransomware negotiator was sentenced to prison for conspiring with the Blackcat\/ALPHV syndicate to provide confidential client negotiating strategies to attackers to maximize extortion amounts.<\/p>\n

As federal authorities continue to untangle the web of complicity surrounding groups like ShinyHunters, the investigation serves as a stark reminder of the challenges facing the cybersecurity sector as it grapples with insiders who cross the line from remediation to extortion.<\/p>\n","protected":false},"excerpt":{"rendered":"

The sprawling federal probe underscores an increasingly murky underworld where the boundaries between cyber defense…<\/p>\n","protected":false},"author":17,"featured_media":2179,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[198],"tags":[146,828,1834,155,1836,184,1835,5,205,169,645,204,170],"class_list":["post-2180","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-phishing-social-engineering","tag-defense","tag-extortion","tag-feds","tag-krebs","tag-negotiator","tag-phishing","tag-ransom","tag-security","tag-security-awareness","tag-shinyhunters","tag-site","tag-social-engineering","tag-suspect"],"_links":{"self":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/2180","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2180"}],"version-history":[{"count":0,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/2180\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/media\/2179"}],"wp:attachment":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2180"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2180"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2180"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}