U.S. federal investigators are currently conducting an expansive probe into the notorious hacking syndicate known as ShinyHunters, uncovering a disturbing network of collusion that extends into the legitimate cybersecurity industry. According to sources close to the investigation, federal authorities have identified executives at two separate ransomware negotiation firms who maintained unusually intimate, and allegedly criminal, relationships with the extortion group. One high-ranking executive in the United States is suspected of having actively assisted ShinyHunters in operating a website specifically designed to pressure victims into paying exorbitant ransoms.
The investigation follows a period of intense activity from the hacking group, which has claimed credit for dozens of major data breaches since 2019. Originally the product of cybercriminals operating out of France, the ShinyHunters brand saw its leadership transition following a series of arrests. The group’s control eventually fell to an individual known as "Rey," identified last year as a teenage hacker based in Amman, Jordan. The FBI estimates that ShinyHunters has successfully extorted more than $70 million from victims within the current year alone.
The agency’s interest in the group reached a fever pitch in late September after ShinyHunters successfully breached the FBI’s own recruitment portal, fbijobs.gov. The hackers taunted the bureau by threatening to leak sensitive internal files, including medical and psychological records, Social Security numbers, home addresses, and specific data regarding employee specializations and units.
The breach of the FBI jobs site prompted an aggressive, rapid-response operation. Federal agents moved swiftly to detain and interrogate anyone suspected of communicating with Rey or his associates. On October 3, Reuters reported that Rey had been taken into custody by Jordanian authorities and was actively cooperating with U.S. investigators.
The chain of events leading to this breakthrough began weeks earlier in the Netherlands. On September 15, 2026, Dutch police executed a high-stakes operation to apprehend Pepijn van der Stap, a convicted hacker and key figure in the ShinyHunters network. Using flash-bang grenades to ensure his immediate incapacitation, officers managed to seize Van der Stap while he was actively logged into his online accounts.
Crucially, authorities were able to access his Signal instant messaging history. The contents of those messages, according to sources familiar with the investigation, provided a roadmap of the group’s operations, including incriminating communications with ransomware negotiators in both Canada and the United States. These chats were also instrumental in uncovering a potential murder-for-hire plot, with Dutch media outlet RTL reporting that Van der Stap had allegedly issued orders for two targeted attacks abroad—though there is no evidence that those orders were ever carried out.
On October 9, the investigation reached a significant milestone when the FBI arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the ShinyHunters case. Dubrovsky, who had recently authored a book on cyber extortion that advocated for engaging with hackers, has been charged with interfering with interstate commerce through extortion and threatening to disclose stolen data. Court records indicate that federal prosecutors have requested that Dubrovsky remain in custody pending trial, and much of the case remains under seal.
Investigations into the digital trail left by Van der Stap suggest that Dubrovsky and at least one executive at a major U.S.-based consulting firm were in frequent contact with the hackers. The evidence indicates that these executives were often privy to the details of new victims before the victims themselves were even aware they had been breached. Most explosively, investigators found that Dubrovsky was aware that ShinyHunters had exfiltrated highly sensitive data from FBI servers but failed to notify the bureau, even as the hackers publicly threatened to expose the agency’s personnel files on social media.
The Rise and Fall of ShinyWire
At the center of the collusion allegations is a now-defunct website known as "shinywire[.]com." Sources indicate that federal investigators believe an executive at a prestigious U.S.-based consulting firm—a company with more than 1,000 employees—played an active role in the site’s operation. While law enforcement has not yet filed charges against this individual, the firm’s proximity to the extortion scheme has sent shockwaves through the cybersecurity industry.
The Shinywire portal, which operated from early May 2026 until mid-October, served as a centralized hub for the group’s extortion demands. It featured entries for nearly 100 organizations that had been compromised by ShinyHunters, offering samples of stolen data as "proof" to coerce victims into payment. The site served as a digital ultimatum: organizations that failed to engage or meet payment demands within seven days faced the permanent publication of their stolen data on the group’s Tor-based "shaming" blog. One such victim, the American medical technology company Intuitive Surgical, was listed on the site following a March 2026 phishing attack that compromised employee credentials.
Ghostbyte and the Shadow Economy
The investigation into the broader ransomware ecosystem has also cast a light on the past activities of industry figures. Before his falling out with Edward Dubrovsky, Daniel Tobok, the former CEO of the Toronto-based cybersecurity firm Cypfer, was allegedly known in certain circles by the handle "Ghostbyte."
Documents reviewed by investigators suggest that as far back as 2018, the Russian-language ransomware group Dharma, which was then actively extorting Canadian companies, directed victims to contact a specific individual at a Canadian IT firm for "guarantees" regarding the deletion of stolen data. The contact email provided by the Dharma representative was [email protected]. While it remains unclear if Tobok actively utilized that specific alias, digital breadcrumbs—including his use of the handle on other platforms—have drawn the attention of researchers.
Cypfer has officially distanced itself from these events. In a statement released on October 14, a company spokesperson denied that Cypfer’s business includes facilitating ransomware payments and asserted that the company had no prior knowledge of Dubrovsky’s arrest. The firm also emphasized that it is not currently the target of any law enforcement investigation.
Conflict of Interest in the Ransomware Industry
The legality of paying a ransom in the United States remains a complex gray area. While paying to regain access to encrypted data is not inherently illegal, payments to groups sanctioned by the U.S. Treasury are prohibited. ShinyHunters, however, has historically existed in a space where they have not been officially sanctioned, allowing some incident response firms to navigate these payments for their clients.
This dynamic has created an environment rife with conflicts of interest. Industry experts note that while some firms charge flat retainers, others take a percentage of the total ransom payment—a model that incentivizes negotiators to favor the hackers’ demands to ensure the deal closes. Mark Camillo, CEO of the industry group CyberAcuView, has criticized this practice, noting that it creates an incentive structure where the negotiator profits more as the ransom amount increases.
"There needs to be more transparency in the process as no one in the ecosystem should be profiting purely on the size of the ransomware transaction," Camillo stated.
The potential for abuse has been demonstrated in recent high-profile cases. In December 2024, the education technology company PowerSchool reportedly paid a $2.85 million ransom to ShinyHunters with the assistance of CyberSteward. Despite the payment, the data was not truly secured, and school districts later faced secondary extortion demands using the same stolen records.
Leading incident response firms, including Coveware and Unit 221B, have consistently advised against paying the group, arguing that hackers rarely honor their word. This stance has made them targets for ShinyHunters, with the group’s leaders complaining in private Telegram chats that these firms were "harming" their payment rates and actively seeking to "eliminate the problem."
As federal prosecutors continue to crack down on the nexus between ransomware gangs and corrupt negotiators, the industry faces a reckoning. Recent prosecutions, such as the charges against MonsterCloud CEO Zohar Pinhasi for allegedly paying hackers while deceiving clients, and the 70-month prison sentence handed to Florida-based negotiator Angelo Martino for conspiring with the Blackcat ransomware group, signal a hardening of the government’s stance. For the victims of ShinyHunters, the revelation that those tasked with their protection may have been in league with their tormentors marks a significant and unsettling development in the fight against cybercrime.
