U.S. federal investigators are meticulously unraveling a complex web of alleged collusion between ransomware negotiation firms and the notorious ShinyHunters hacking group, with compelling evidence pointing to at least one U.S.-based executive actively participating in the operation of the group’s victim extortion website, "shinywire[.]com." This revelation, uncovered by KrebsOnSecurity, emerges amidst an intensifying federal crackdown on ShinyHunters, a group that has amassed over $70 million this year through audacious data breaches, including a recent, high-profile attack on the FBI’s own recruitment portal.

The ShinyHunters collective, initially a French-led operation since 2019, has evolved significantly. Following the arrests and incarcerations of its original members, operational control reportedly shifted to a teenage hacker known as "Rey," identified as being from Amman, Jordan. Rey’s ascension coincided with the high-stakes FBI jobs site hack in late September, an act of defiance that prompted the bureau to expedite investigations into individuals with ties to the group. This swift action led to the detention of Rey in Jordan, who is now cooperating with the FBI, as reported by Reuters on October 3rd. The groundwork for Rey’s control was laid just weeks prior with the apprehension of alleged senior ShinyHunters member Pepijn van der Stap in the Netherlands on September 15, 2026. Dutch police, employing dramatic flash-bang tactics, apprehended Van der Stap while he was actively logged into online accounts, crucially gaining access to his Signal communications.

These intercepted messages proved instrumental, revealing not only unusual connections to ransomware negotiators but also surfacing an alleged murder-for-hire plot orchestrated by Van der Stap, as reported by Dutch outlet RTL. The investigation’s focus then sharpened on Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, whose arrest by the FBI on October 9th was first reported by KrebsOnSecurity. Dubrovsky, the author of a book advocating for engagement with hackers, faces charges of threatening to disclose hacked data and interfering with interstate commerce through extortion. Court records indicate prosecutors are seeking his detention pending trial, with case details under seal, as reported by Politico.

Sources close to the investigation revealed that Van der Stap’s Signal chats detailed frequent communications with Dubrovsky and at least one executive at a prominent U.S. consulting firm. These individuals, alarmingly, appeared to possess intimate knowledge of ShinyHunters’ victims before the victims themselves were even aware of the breaches. Most damningly, Van der Stap’s messages indicated that Dubrovsky was aware of the sensitive FBI data breach and failed to alert the bureau prior to ShinyHunters’ public threat to release the personnel files.

The alleged involvement of a U.S.-based executive in operating the now-defunct "shinywire[.]com" website represents a significant escalation. While the executive and their affiliated prestigious firm, boasting over 1,000 associates, have not yet been charged, two sources familiar with the ShinyHunters probe confirmed investigators’ belief in their active role. The Shinywire website, operational from approximately May 3, 2026, to October 16, 2026, listed nearly 100 organizations targeted by ShinyHunters. Each entry served as a digital extortion notice, urging victims to negotiate payment, showcasing samples of stolen data, and threatening public release if demands were ignored. A cached version of the site targeting Intuitive Surgical, a medical technology company breached in March 2026, highlights the site’s function: demanding engagement within seven days, after which stolen data would be published on the ShinyHunters’ Tor-accessible victim-shaming blog.

Adding another layer of complexity, Edward Dubrovsky recently alleged in court documents, prior to his arrest, that he was a victim of a smear campaign by a former business partner, Daniel Tobok, the ex-CEO of Cypfer, a cybersecurity firm with global reach. Their partnership, which began in 2017, soured by 2024, with Dubrovsky accusing Tobok of exclusion and erratic decision-making. Tobok, in turn, countersued, alleging Dubrovsky accessed confidential information and competed unfairly through his work at CyberSteward Inc.

Further illuminating the shadowy world of ransomware negotiation, Tobok has been known to ransomware purveyors for at least eight years by the moniker "Ghostbyte." Evidence suggests a connection dating back to 2018 when a Canadian company, hacked by the Dharma ransomware group, was advised by a Dharma representative to contact an IT firm via the email address [email protected] for guarantees regarding data recovery. While Tobok has not commented, his frequently used email address, [email protected], is linked to online accounts where "ghostbyte" was chosen as the username, including a Snapchat account, according to Constella Intelligence. The Dharma representative’s email address, [email protected], is also linked to a cryptocurrency address that processed significant transactions, totaling 43 Bitcoin, equivalent to approximately $3.5 million today.

Cypfer, in a statement on October 14, asserted that its business does not involve facilitating ransomware payments and that the company was unaware of Dubrovsky’s arrest. They also clarified that CyberSteward and Cypfer are separate entities, with Cypfer recently acquired by Apros Group, led by Jason Hogg, a former FBI special agent and CEO of Aon Cyber Solutions Group. Notably, Aon acquired Cytelligence in 2020, a firm where both Tobok and Dubrovsky held significant roles.

The legality of paying ransomware demands remains a complex issue. While not illegal in the U.S. unless the sanctioned entity is paid, the practice is fraught with ethical and practical challenges. Insurance providers often direct victims to specific incident response firms, but those unwilling to facilitate payments are frequently replaced by companies that will. The case of PowerSchool, which reportedly paid a $2.85 million ransom to ShinyHunters in December 2024 following a breach affecting millions of students and teachers, exemplifies this. Despite the payment, individual school districts later faced separate extortion attempts using the same stolen data, underscoring the inherent unreliability of assurances from threat actors. Leading firms like Coveware and Unit 221B have consistently warned against paying ShinyHunters, citing instances of data being retained, resold, or used for further extortion. The FBI echoed these warnings in a May 15, 2026 alert, prompting harassment and threats against these advisory firms from ShinyHunters members.

Internal communications from ShinyHunters, shared with KrebsOnSecurity, reveal significant frustration with Coveware’s stance. The group’s Telegram account complained that Coveware’s advice against payment was directly impacting their "payment rates" and actively hindering negotiations. In one instance, the account stated, "Go on my website, majority of those companies would’ve paid if it weren’t for Coveware giving them misinformation," and later, "Someone (100% Coveware) is going out of their way to make sure i am not paid." Another conversation revealed an intent to "eliminate the problem," referring to Coveware’s advisory role.

Mark Camillo, CEO of CyberAcuView, an industry group founded by major cyber insurance carriers, highlights the inherent conflict of interest in ransomware negotiation firms charging a percentage of the ransom paid. This model incentivizes negotiators to favor attackers, potentially leading to inflated payments and a lack of transparency. Camillo emphasizes the need for greater visibility into transactions and clearer understanding of cryptocurrency exchange fees to align incentives within the ecosystem.

The U.S. Department of Justice has been actively prosecuting ransomware negotiators for conspiracy and fraud. Zohar Pinhasi, CEO of MonsterCloud, was charged on October 7th with wire fraud and conspiracy for allegedly charging customers for ransomware remediation without paying hackers, instead secretly disbursing $8 million to ransomware groups while billing clients $19 million. In July, Angelo Martino, a Florida-based ransomware negotiator, was sentenced to 70 months in prison for conspiring with the Blackcat/ALPHV group, providing confidential client information to maximize ransom payouts. These cases underscore a growing trend of law enforcement targeting individuals who allegedly exploit the vulnerabilities of victims for personal gain, often in direct collaboration with cybercriminals.