U.S. federal investigators, currently locked in an aggressive pursuit of the prolific hacking syndicate known as "ShinyHunters," have uncovered evidence of a disturbing collaboration between the criminals and executives at professional ransomware negotiation firms. According to sources familiar with the investigation, federal agents have identified executives at two separate firms who maintained unusually close, and potentially criminal, relationships with the extortionists. In at least one instance, a U.S.-based executive is alleged to have actively assisted the group in maintaining an online portal designed to pressure victims into meeting ransom demands.
The ShinyHunters collective has become a primary target for law enforcement since 2019, when the group first emerged under the operation of cybercriminals based in France. Over the years, as original members were systematically identified and apprehended, the brand evolved, eventually falling under the control of a figure known as "Rey"—a teenage hacker identified last year as being based in Amman, Jordan. The FBI estimates that the group’s activities have resulted in the extortion of more than $70 million from various organizations throughout this year alone.
The investigation reached a fever pitch in late September after ShinyHunters compromised the FBI recruitment website, fbijobs.gov. The hackers taunted the federal agency by threatening to leak a cache of sensitive files, which allegedly contained Social Security numbers, home addresses, and detailed medical and psychological records of FBI personnel, along with information regarding their specific professional units and specializations. This brazen intrusion prompted an accelerated law enforcement response, leading to a series of swift arrests and interrogations of individuals linked to the group’s inner circle. On October 3, Reuters reported that Rey had been detained by authorities in Jordan and was actively cooperating with federal investigators.
The Downfall of a Key Operative
The leadership transition that saw Rey assume control of ShinyHunters was necessitated by the sudden neutralization of a senior member. On the evening of September 15, 2026, Dutch authorities executed a high-stakes operation to apprehend Pepijn van der Stap, a convicted hacker and core suspect in the ShinyHunters investigation. Reports indicate that police utilized flash-bang grenades to disorient Van der Stap, preventing him from wiping his digital footprint while he was actively logged into his accounts.
Crucially, authorities arrested Van der Stap while he was utilizing the Signal encrypted messaging application. This allowed investigators to gain access to his recent communication logs, which included candid conversations with ransomware negotiators based in both Canada and the United States. Sources close to the investigation suggest that these messages provided the thread that unraveled a broader criminal tapestry, including a potential murder-for-hire plot. While there is no evidence that the lethal orders were ever carried out, reports from the Dutch news outlet RTL indicated that the plots were allegedly intended to be executed abroad at the direction of Van der Stap.
The Arrest of Edward Dubrovsky
On October 9, the investigation crossed a major threshold when the FBI arrested 54-year-old Canadian cybersecurity executive Edward Dubrovsky. Dubrovsky, a prominent figure in the industry who recently authored a book on navigating cyber extortion—in which he famously advocated for proactive engagement with hackers—now faces charges of threatening to disclose stolen data and interfering with interstate commerce through extortion. According to federal court records, prosecutors have moved to keep Dubrovsky in custody pending trial, with much of the case documentation remaining under seal.
Internal communications retrieved from Van der Stap’s Signal account reportedly reveal a troubling pattern: Dubrovsky and at least one other executive at a major U.S.-based consulting firm appeared to be privy to details regarding new ShinyHunters victims before those victims were even aware of their own data breaches. Perhaps most explosively, investigators believe these messages demonstrate that Dubrovsky was aware that ShinyHunters had successfully compromised highly sensitive FBI servers but failed to notify the bureau before the group publicly threatened to release the stolen personnel files on social media.
The Role of Shinywire
Federal investigators are now focusing on the role of "shinywire[.]com," a now-defunct website that functioned as a centralized hub for the group’s extortion efforts. Sources indicate that at least one executive at a prestigious, large-scale U.S. consulting firm—which employs more than 1,000 associates—is suspected of playing an active role in the operation of this site. While the company and the individual remain unnamed pending formal charges, the evidence suggests a high level of operational integration between the "security" firm and the criminal enterprise.
Active from May 2026 until mid-October, the Shinywire portal hosted entries for nearly 100 organizations that had been targeted by ShinyHunters. Each entry functioned as a digital ultimatum, providing samples of stolen data and a ticking clock, with the promise that the full cache of private information would be released on the group’s Tor-based leak site if the ransom demands were not met. For example, when the American medical technology company Intuitive Surgical was breached in March 2026 following a targeted phishing attack, the extortion demands were indexed and managed through this professionalized interface.
A History of "Ghostbyte"
The investigation has also shed light on the past of Daniel Tobok, the former chief executive of the cybersecurity firm Cypfer. Several former colleagues have identified Tobok as being known by the handle "Ghostbyte" in ransomware circles as far back as 2018. During that year, a Canadian company targeted by the Dharma ransomware group was directed by the hackers to contact an individual at a Canadian IT firm to negotiate a "guarantee" for the recovery of their files. The email response from the Dharma representative explicitly instructed the victim to reach out to the address "[email protected]," claiming that this specific contact was the person who "often solves such problems in Canada."
While it remains unconfirmed whether Tobok personally utilized that specific address, digital footprint analysis by Constella Intelligence links an email address frequently used by Tobok—[email protected]—to online accounts registered under the "ghostbyte" username. Furthermore, the cryptocurrency wallet associated with the Dharma representative’s email address has been linked to significant financial activity, including 38 transactions totaling 43 bitcoin, valued at approximately $3.5 million today.
In response to these developments, Cypfer issued a statement on October 14, asserting that the company does not facilitate ransomware payments and claiming they were unaware of Dubrovsky’s arrest until it was reported by the media. The firm stated that it has had no outreach from law enforcement and does not believe it is the target of any investigation.
Conflicting Incentives in the Ransomware Industry
The legal status of paying ransom remains a complex landscape. In the United States, paying for a decryption key is not inherently illegal, provided the ransomware group is not on the U.S. Treasury Department’s sanctioned list. However, industry experts are increasingly concerned about the inherent conflict of interest when incident response firms act as negotiators.
Mark Camillo, CEO of the industry group CyberAcuView, noted that many firms charge a percentage of the final ransom payment rather than a flat fee. This creates a perverse incentive for the negotiator to maximize the ransom amount or pressure the victim into paying, as their own commission scales with the size of the payout. "There needs to be more transparency in the process, as no one in the ecosystem should be profiting purely on the size of the ransomware transaction," Camillo stated.
This misalignment of incentives has caught the attention of the Department of Justice. The recent prosecution of MonsterCloud CEO Zohar Pinhasi, who allegedly paid hackers $8 million while charging clients $19 million, and the sentencing of negotiator Angelo Martino for his role in conspiring with the Blackcat/ALPHV group, signal a shift in how federal authorities view the intersection of cybersecurity consulting and criminal extortion.
As the FBI continues its probe into the remnants of the ShinyHunters network, the case serves as a stark warning to organizations that rely on third-party firms to manage cyber crises. With evidence mounting that some negotiators may be playing both sides of the fence, the line between victim advocate and criminal co-conspirator is becoming increasingly blurred, leaving companies to grapple with the uncomfortable reality that their "remediation" partners may be part of the very threat they were hired to neutralize.
