Feds Investigate Ransom Negotiators Linked to ShinyHunters Extortion Site
Federal authorities uncover cybersecurity executives allegedly operating extortion portals for the notorious ShinyHunters hacking group.
1Federal Investigation into Negotiators
U.S. federal investigators have identified executives at two ransomware negotiation firms maintaining close ties with the ShinyHunters hacking group. Sources indicate one U.S.-based executive allegedly helped operate a website designed to pressure victims into paying ransoms. This investigation marks a significant escalation in tracking those who facilitate cyber extortion payments.
2Evolution of ShinyHunters Group
Originally operated by cybercriminals in France since 2019, the ShinyHunters brand shifted control to a teenage hacker known as Rey, based in Amman, Jordan. The group has extorted over $70 million this year alone. Following the FBI jobs site hack, authorities moved quickly to detain Rey, who is now cooperating.
3The Arrest of Pepijn van der Stap
Dutch authorities arrested suspect Pepijn van der Stap on September 15, 2026, using flash-bang grenades during his active session. Police accessed his Signal messaging account, revealing critical communications with ransomware negotiators in Canada and the U.S. These messages were instrumental in uncovering a potential murder-for-hire plot linked to the suspect.
4Charges Against Edward Dubrovsky
The FBI arrested 54-year-old Canadian cybersecurity executive Edward Dubrovsky on October 9. He faces charges of threatening to disclose stolen data and interfering with interstate commerce. Prosecutors have requested he remain in custody pending trial. Court records remain under seal as the investigation into his alleged extortion activities continues to unfold.
5Evidence of Prior Knowledge
Investigators found that Dubrovsky’s messages showed he knew ShinyHunters had stolen sensitive FBI data. Despite this, he failed to inform the bureau before the group threatened to publish personnel files on Twitter/X. This failure to report suggests a deeper level of complicity than merely acting as a standard third-party negotiator.
6Operation of Shinywire Portal
Federal investigators believe at least one executive at a prestigious U.S. consulting firm helped operate the now-defunct extortion site, shinywire.com. The site listed nearly 100 hacked organizations, providing samples of stolen files to pressure victims. The firm remains unnamed as no formal charges have been filed against its specific employees yet.
7Extortion Tactics and Timelines
The Shinywire website operated from May 3, 2026, until October 16. It functioned as a pressure mechanism, giving victims seven days to negotiate before their data was published on a Tor-based shaming blog. This automated extortion model targeted companies like Intuitive Surgical, which suffered a breach following a successful phishing attack.
8Internal Industry Conflicts
Before his arrest, Dubrovsky filed a lawsuit against Daniel Tobok, his former business partner at the cybersecurity firm Cypfer. The legal battle involved allegations of capricious decision-making and unfair competition. These internal industry disputes have inadvertently surfaced historical links, including a 2018 Dharma ransomware case involving the alias Ghostbyte.
9The Ghostbyte Connection
Evidence suggests the alias Ghostbyte was used by a representative of the Dharma ransomware group to direct victims toward a Canadian IT firm for payment guarantees. Constella Intelligence found that an email address frequently used by Daniel Tobok is associated with online accounts using the Ghostbyte username, linking him to past extortion.
10Corporate Stance on Payments
Cypfer stated it does not facilitate ransomware payments and was unaware of Dubrovsky’s arrest until media reports surfaced. The company noted it is separate from CyberSteward, another firm involved in the PowerSchool breach. Cypfer was recently acquired by Apros Group, led by former FBI special agent Jason Hogg, following previous industry consolidations.
11The Risks of Paying Ransoms
While paying for decryption keys is not illegal in the U.S. unless the group is sanctioned, experts warn against it. The PowerSchool incident, where a $2.85 million payment failed to prevent subsequent extortion, highlights the impossibility of verifying that hackers actually delete stolen data. Victims often face repeated demands from secondary actors.
12Industry Resistance to Extortion
Leading incident response firms like Coveware and Unit 221B actively advise against paying ShinyHunters. This stance has drawn direct harassment from the hacking group, which blamed these firms for lower payment rates. The FBI’s May 2026 alert further solidified the official position that paying these criminals only fuels future cyberattacks.