{"id":2312,"date":"2026-10-21T14:05:25","date_gmt":"2026-10-21T14:05:25","guid":{"rendered":"https:\/\/smartcryptosecurity.com\/?p=2312"},"modified":"2026-10-21T14:05:25","modified_gmt":"2026-10-21T14:05:25","slug":"u-s-investigators-tie-ransomware-negotiation-firm-executives-to-the-shinyhunters-hacking-group-and-fbi-data-breach","status":"publish","type":"post","link":"https:\/\/smartcryptosecurity.com\/?p=2312","title":{"rendered":"U.S. Investigators Tie Ransomware Negotiation Firm Executives to the ShinyHunters Hacking Group and FBI Data Breach"},"content":{"rendered":"

U.S. federal investigators pursuing the notorious ShinyHunters hacking group\u2014which recently compromised and stole highly sensitive data from the FBI\u2014have identified executives at two separate ransomware negotiation firms who maintained unusually close and illicit ties with the extortion syndicate. Sources close to the ongoing investigation reveal that one of these U.S.-based executives even went so far as to help ShinyHunters operate a dedicated pressure website designed to coerce victims into paying exorbitant ransoms.<\/p>\n

Hackers aligned with the ShinyHunters banner have claimed responsibility for dozens of high-profile data breaches since 2019. The collective was initially operated by cybercriminals residing in France, but as those original members were systematically arrested and jailed, control of the brand ultimately transitioned to a teenage hacker from Amman, Jordan, known online as \u201cRey,\u201d who was identified by security researchers last year. According to FBI estimates, ShinyHunters has successfully extorted more than $70 million from victims over the course of the year.<\/p>\n

The group\u2019s brazen activities reached a crescendo in late September when ShinyHunters compromised the FBI recruitment website, fbijobs.gov. The hackers publicly taunted federal law enforcement by threatening to publish a trove of stolen files. Reports indicated these compromised documents included deeply sensitive materials such as medical and psychological records, Social Security numbers, home addresses, and detailed information regarding individual employees’ specialized units and assignments.<\/p>\n

The breach of the FBI recruitment portal prompted the agency to move with extraordinary speed to arrest, detain, and question individuals suspected of communicating with Rey or other key ShinyHunters associates. On October 3, Reuters reported that Rey had been detained by Jordanian authorities and was actively cooperating with federal investigators.<\/p>\n

Rey had managed to assume control over the hacking group because one of its principal senior members had been captured just weeks prior. On the evening of September 15, law enforcement officers in the Netherlands executed a dramatic raid, arresting convicted hacker and ShinyHunters suspect Pepijn van der Stap. Dutch police reportedly deployed flash-bang grenades to stun and apprehend Van der Stap while he was actively logged into multiple online accounts.<\/p>\n

According to sources close to the investigation, authorities apprehended Van der Stap while he was using his Signal instant messaging account. This tactical advantage allowed investigators to access recent communications with frequent contacts, including ransomware negotiators operating out of Canada and the United States. <\/p>\n

\"Feds<\/figure>\n

Multiple sources with direct knowledge of the matter indicated that Van der Stap\u2019s Signal messages proved critical in unraveling a chilling murder-for-hire plot that surfaced immediately following his arrest. Dutch news outlet RTL reported last month that two murders were allegedly planned to be carried out abroad, with investigators finding indications that Van der Stap had issued the orders for the attacks, though there is no evidence those directives were ever executed.<\/p>\n

On October 9, KrebsOnSecurity broke the news that the FBI had arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the escalating ShinyHunters investigation. Dubrovsky, who recently published a book on handling cyber extortion that advised victims to always engage with hackers, was formally charged with threatening to disclose stolen data and interfering with interstate commerce through extortion, according to federal court records. Politico reported that prosecutors requested Dubrovsky remain in custody pending trial, with court records related to the case kept under seal.<\/p>\n

A source close to the probe revealed that Van der Stap\u2019s decrypted Signal messages demonstrated frequent conversations between the Dutch hacker, Dubrovsky, and at least one executive at a major U.S.-based consulting firm. Notably, these executives frequently possessed intimate details regarding newly targeted ShinyHunters victims before the victim organizations themselves were even aware they had been breached.<\/p>\n

Investigators uncovered another potentially explosive detail in the Dutch hacker’s chat logs: Dubrovsky was fully aware that ShinyHunters had successfully stolen highly sensitive data from FBI servers. Despite this knowledge, he never alerted the bureau prior to the hackers utilizing Twitter and X to threaten the public release of the agency’s deeply personal personnel files.<\/p>\n

SHINYWIRE<\/h2>\n

Federal investigators believe at least one executive at a prominent U.S.-based consulting firm played an active operational role in running the now-defunct ShinyHunters victim extortion portal known as "shinywire.com." While the specific U.S. company and the suspected executive have not yet been publicly named by law enforcement because formal criminal charges have not been filed, sources describe the entity as a prestigious firm with a workforce exceeding 1,000 associates.<\/p>\n

The Shinywire platform remained active from approximately May 3 until October 16, featuring extortion entries for nearly 100 organizations that had fallen victim to ShinyHunters. Each listing aggressively urged victim companies to engage with the cybercrime syndicate to negotiate payment terms, supplementing the demands with samples of stolen files and explicit warnings that the full data caches would be published online if demands were ignored.<\/p>\n

\"Feds<\/figure>\n

Cached records from monitoring services like urlscan.io highlighted extortion demands targeting major enterprises, such as the American medical technology firm Intuitive Surgical, which was breached in March following a targeted employee phishing campaign. Under the group’s operational model, victim organizations that refused to engage or negotiate within a strict seven-day window found their stolen intellectual property and internal records published directly onto the ShinyHunters victim-shaming blog, which was accessible exclusively via the Tor anonymity network.<\/p>\n

The widening dragnet has also brought internal corporate disputes to light. In mid-October, The Globe and Mail reported that months prior to his arrest, Edward Dubrovsky had alleged in Canadian court documents that he had become collateral damage in a malicious campaign orchestrated by a former business partner seeking to ruin another industry executive. <\/p>\n

Dubrovsky had filed a lawsuit in Ontario against Daniel Tobok, the former chief executive of Cypfer, a prominent cybersecurity firm founded in Toronto with international offices spanning the United States, Britain, the Netherlands, the United Arab Emirates, and Mexico. The two men initially partnered in 2017 to build Cypfer, where Dubrovsky served as managing partner and chief operating officer. However, by 2024, their relationship fractured amid accusations that Tobok was freezing Dubrovsky out of core business operations and making erratic corporate decisions. <\/p>\n

Tobok vehemently denied the allegations and filed a counterclaim accusing Dubrovsky of misappropriating confidential information and engaging in unfair competition through a separate venture called CyberSteward Inc., while asserting that Dubrovsky was merely an employee rather than a founder or equity shareholder.<\/p>\n

GHOSTBYTE<\/h2>\n

Interviews with several former colleagues of Daniel Tobok indicate that as far back as eight years ago, he was known within select cybercrime and ransomware circles by a specific online pseudonym: "Ghostbyte." In 2018, a Canadian company fell victim to Dharma, a prolific Russian-language ransomware affiliate program operational since 2016. When the victim informed the Dharma representative that they were leaning toward paying the ransom because critical encrypted files could not be recovered, they requested firmer guarantees that the cybercriminals would honor their word.<\/p>\n

In a redacted email response provided by the Dharma representative, the ransomware operators instructed the victim to contact an IT professional in Canada who specialized in securing such agreements, directing them to the email address ghostbyte@tutanota.com. The representative advised the company to reach out directly, noting that the individual frequently resolved similar extortion dilemmas in Canada under a formal service contract.<\/p>\n

\"Feds<\/figure>\n

While it remains officially unconfirmed whether Tobok personally utilized the Ghostbyte address supplied by the Dharma affiliate, the breach-tracking intelligence service Constella Intelligence identified that an email address frequently used by Tobok\u2014dtobok@me.com\u2014was tied to online accounts utilizing the "ghostbyte" username, including a Snapchat profile. Furthermore, Constella established that the Dharma representative\u2019s email address was linked to a cryptocurrency wallet that processed dozens of transactions totaling substantial sums of Bitcoin.<\/p>\n

In a formal statement released in mid-October, Cypfer maintained that its core business operations do not involve facilitating or making ransomware payments. The company stated that it learned of Dubrovsky\u2019s arrest through media reports and had no prior awareness of the federal probe, adding that it has received no outreach from law enforcement and is not the target of any ongoing investigation. <\/p>\n

The statement further clarified that CyberSteward and Cypfer operate as entirely separate corporate entities with no overlapping officers, directors, or employees. Cypfer was recently acquired by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. Aon previously acquired Cytelligence in 2020, a security consulting firm where Tobok served as founder and CEO and Dubrovsky served as managing partner.<\/p>\n

CONFLICTING INTERESTS<\/h2>\n

Under U.S. law, it is not inherently illegal for victim organizations to pay hackers for decryption keys or in exchange for promises to delete stolen files. Legal complications typically arise only if ransoms are paid to terrorist groups or entities explicitly sanctioned by the U.S. Department of Treasury\u2019s Office of Foreign Assets Control, a category that currently does not include ShinyHunters.<\/p>\n

Cybersecurity experts note that ransomware victims are frequently directed by their cyber insurance carriers to retain specific incident response firms. However, because not all forensic firms are willing to facilitate extortion payments, corporate clients often switch to negotiation-friendly providers when they decide to pay.<\/p>\n

The landscape is further complicated by financial incentives. In December 2024, ShinyHunters targeted the education technology firm PowerSchool, stealing private records belonging to 62 million students and 9.5 million teachers across the U.S. and Canada. PowerSchool reportedly paid a $2.85 million ransom, with disclosure documents indicating they were assisted by CyberSteward. A 20-year-old ShinyHunters affiliate from Massachusetts was subsequently sentenced to four years in prison for his role in the attack.<\/p>\n

\"Feds<\/figure>\n

Despite the payment, the extortion continued. By May, individual school districts began receiving independent ransom demands utilizing samples from the same stolen dataset, reinforcing the reality that paying cybercriminals offers no technical guarantee that data has actually been destroyed or that other criminal actors have not retained copies.<\/p>\n

Leading incident response firms, including Coveware and Unit 221B, have consistently warned organizations against paying ShinyHunters, pointing out that stolen data is frequently retained, resold, or weaponized to target clients directly at a later date. The FBI issued a public advisory echoing these warnings. <\/p>\n

Internal communications recovered by investigators highlighted the deep friction these warnings caused for the hackers. In private Telegram chats from April and May, ShinyHunters operators complained bitterly that Coveware was actively ruining their business model by discouraging victims from paying. The chat logs showed the group’s lead administrator discussing ways to eliminate the interference caused by Coveware’s public stance.<\/p>\n

Industry experts have increasingly scrutinized the financial models used by some remediation firms. Mark Camillo, CEO of CyberAcuView\u2014an industry group established by major cyber insurers\u2014noted that while some firms charge flat retainers, others take a percentage of the total ransom paid. Camillo argued that percentage-based fee structures create an inherent conflict of interest, giving negotiators a financial incentive to encourage payouts and discourage aggressive downward bargaining.<\/p>\n

The Department of Justice has increasingly targeted such abuses through criminal prosecutions. In October, federal prosecutors charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy for allegedly charging clients millions for remediation while secretly paying hackers behind their backs. Similarly, in July, a Florida-based ransomware negotiator was sentenced to over five years in prison for conspiring with the BlackCat\/ALPHV ransomware group to compromise client negotiation strategies and maximize extortion payouts.<\/p>\n","protected":false},"excerpt":{"rendered":"

U.S. federal investigators pursuing the notorious ShinyHunters hacking group\u2014which recently compromised and stole highly sensitive…<\/p>\n","protected":false},"author":10,"featured_media":2311,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[198],"tags":[165,206,146,1798,461,176,144,1794,1797,184,337,205,169,204],"class_list":["post-2312","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-phishing-social-engineering","tag-breach","tag-data","tag-defense","tag-executives","tag-firm","tag-group","tag-hacking","tag-investigators","tag-negotiation","tag-phishing","tag-ransomware","tag-security-awareness","tag-shinyhunters","tag-social-engineering"],"_links":{"self":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/2312","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2312"}],"version-history":[{"count":0,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/2312\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/media\/2311"}],"wp:attachment":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2312"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2312"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2312"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}