U.S. federal investigators are intensifying their pursuit of the prolific hacking collective known as "ShinyHunters," an operation that has recently escalated its activities to include the theft of highly sensitive data from the Federal Bureau of Investigation. As the investigation deepens, authorities have uncovered a disturbing new layer of the cyber-extortion ecosystem: federal investigators have identified executives at two distinct ransomware negotiation firms who allegedly maintained unusually close, illicit relationships with the hacking group.
Sources close to the ongoing investigation indicate that at least one U.S.-based executive allegedly provided active assistance to the hackers, helping them manage a victim-extortion website designed to pressure organizations into paying illicit ransom demands. This revelation marks a significant turning point in the government’s efforts to dismantle the infrastructure supporting large-scale ransomware attacks.
The Rise of ShinyHunters and the "Rey" Connection
Since its emergence in 2019, ShinyHunters has claimed responsibility for a staggering number of high-profile data breaches. Initially, the group was operated by cybercriminals based in France. However, as the original core members were systematically identified, arrested, and imprisoned by international law enforcement agencies, the leadership of the brand shifted. By last year, investigators had identified "Rey"—a teenage hacker operating out of Amman, Jordan—as the primary administrator of the group. According to FBI assessments, ShinyHunters has successfully extorted more than $70 million from victims within the current calendar year alone.
The group’s brazen nature was on full display in late September 2026, when they successfully breached the FBI recruitment portal, fbijobs.gov. The attackers taunted the federal agency by threatening to leak sensitive personnel data, including medical and psychological records, Social Security numbers, home addresses, and detailed information regarding the specific units and specializations of FBI employees. This high-stakes intrusion triggered an aggressive response from the Bureau, which began moving with unprecedented speed to track down and detain individuals with any documented contact with Rey or his associates. Reuters reported on October 3 that Rey had been taken into custody by Jordanian authorities and is currently cooperating with the FBI.
The Collapse of the Inner Circle
The transition of power within ShinyHunters was facilitated by the downfall of a key senior member. On the evening of September 15, 2026, Dutch authorities executed a high-stakes raid to arrest Pepijn van der Stap, a convicted hacker and core suspect in the ShinyHunters investigation. Reports from the Netherlands suggest that police utilized flash-bang grenades to neutralize Van der Stap while he was actively logged into his various online accounts.
According to sources close to the investigation, the arrest of Van der Stap was a tactical masterstroke. At the time of his apprehension, he was using the Signal encrypted messaging application. His capture allowed investigators to intercept real-time communications with frequent contacts, including ransomware negotiators based in both Canada and the United States.
Beyond the immediate scope of the hacking operation, these intercepted messages provided investigators with the keys to unraveling a suspected murder-for-hire plot. Dutch media outlet RTL reported last month that evidence suggested Van der Stap had allegedly ordered two contract killings to be carried out abroad. While there is no current indication that these orders were executed, the gravity of the plot underscores the dangerous nature of the criminal enterprise.
Arrests in the Ransomware Negotiation Industry
On October 9, the FBI arrested 54-year-old Edward Dubrovsky, a Canadian cybersecurity executive, in connection with the ongoing ShinyHunters probe. Dubrovsky, who had recently authored a book on the management of cyber-extortion that advocated for engaging with hackers, was charged with interfering with interstate commerce through extortion and threatening to disclose stolen data. According to court records, federal prosecutors have requested that Dubrovsky remain in custody as his case proceeds, and much of the documentation currently remains under seal.
The investigation into Van der Stap’s digital footprint has been instrumental. Sources report that his Signal chats revealed frequent, ongoing conversations with Dubrovsky and at least one other executive at a prominent, large-scale U.S. consulting firm. Investigators found that these executives were often privy to the details of new ShinyHunters breaches before the victims themselves were even aware they had been compromised. Perhaps most alarmingly, federal investigators discovered evidence suggesting that Dubrovsky was aware of the theft of highly sensitive FBI data but failed to notify the Bureau, even as ShinyHunters used social media to threaten the publication of the agency’s internal files.
The "Shinywire" Extortion Infrastructure
Federal investigators believe that at least one executive at a prestigious U.S. consulting firm—a company with more than 1,000 employees—played a central role in operating "shinywire.com," a now-defunct extortion website. While federal authorities have not yet formally charged the executives or the firm involved, the existence of the site provided a streamlined portal for the group’s criminal activities.
The Shinywire website was operational from early May 2026 until mid-October and featured nearly 100 entries for organizations victimized by the group. Each entry served as a pressure point, urging the target company to open negotiations, offering samples of stolen files as proof of compromise, and threatening the public release of the data if demands were not met. For example, when Intuitive Surgical was breached in March 2026 following a successful phishing attack, the company’s data was indexed on the Shinywire portal as part of the group’s extortion strategy. Victims who failed to engage within a week faced the automatic publication of their stolen data on the group’s Tor-based shaming blog.
Professional Conflicts and the "Ghostbyte" Allegations
The arrest of Edward Dubrovsky has also cast a light on his previous professional entanglements. Earlier this year, Dubrovsky filed a lawsuit in Ontario against Daniel Tobok, the former CEO of the cybersecurity firm Cypfer. The lawsuit, which alleged that Tobok had attempted to "destroy" him through a series of capricious business decisions, was met with a counterclaim from Tobok alleging that Dubrovsky had engaged in unfair competition and unauthorized access to confidential information.
Further complicating the narrative, former colleagues of Tobok have claimed that he was known in certain circles by the handle "Ghostbyte" as early as 2018. During that year, a Canadian company targeted by the Dharma ransomware group was advised by the attackers to reach out to a specific email address—[email protected]—to ensure that the ransom payment would lead to the promised recovery of their files. While it remains unproven whether Tobok utilized that specific address, breach-tracking services have noted that Tobok’s personal email address has been linked to online accounts using the "Ghostbyte" username.
Cypfer, in a statement provided on October 14, maintained that the company does not facilitate or make ransomware payments and that it had no prior knowledge of Dubrovsky’s arrest. The firm emphasized that it is not currently the target of any law enforcement investigation and noted that it had been acquired by the Apros Group, led by former FBI special agent Jason Hogg.
The Debate Over Ransomware Payments
The legal landscape surrounding ransom payments in the United States remains complex. While paying a ransom is not inherently illegal, it becomes a federal offense if the payment is made to a group sanctioned by the U.S. Treasury Department. ShinyHunters is not currently on the sanctions list, yet the industry faces a growing ethical crisis.
Many cyber insurance carriers direct victims to specific incident response firms to manage the crisis. However, because some firms derive a percentage of the final ransom as their fee, critics argue there is an inherent, perverse incentive to encourage payments rather than negotiate them down or explore other recovery options. Industry experts, such as Mark Camillo, CEO of the cyber insurance industry group CyberAcuView, have called for greater transparency, noting that the profit-sharing model between negotiators and the size of the ransom payout is deeply problematic.
Meanwhile, the FBI continues to issue warnings against paying the ShinyHunters group, citing the impossibility of verifying that stolen data has truly been deleted. Despite this, some firms persist in their facilitation. Internal communications from ShinyHunters suggest the group viewed ethical firms like Coveware—which has consistently advised against paying—as a direct threat to their profitability. In private messages, the group expressed deep frustration that Coveware’s advice was "harming" their ability to secure payments, indicating that the firm’s commitment to security ethics was successfully disrupting their criminal business model. As federal prosecutions of unscrupulous negotiators like Zohar Pinhasi and Angelo Martino continue, the industry faces a reckoning regarding the role of third-party facilitators in the modern cyber-extortion landscape.
