# Federal Investigators Link Ransom Negotiators to ShinyHunters Extortion Operations Cybersecurity executives face scrutiny for alleged involvement in a major global extortion scheme. - **Source:** [Krebs on Security](https://brifing.si/source/0a287077-2ca9-4c5d-b9aa-b7b61aa8e436) - **Published:** 2026-10-19 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/1812eaaf-efae-4cd7-8d8f-b4b22e464ceb ## ShinyHunters Investigation Escalates U.S. federal investigators are probing deep ties between the ShinyHunters hacking group and ransomware negotiation firms. Authorities identified executives who maintained unusually close relations with the extortionists. One U.S.-based executive allegedly helped operate the Shinywire website, which pressured victims to pay ransoms. This investigation highlights a disturbing intersection between professional security services and criminal actors. ## The Rise of ShinyHunters Since 2019, ShinyHunters has claimed credit for dozens of major data breaches. Originally operated by cybercriminals in France, control eventually shifted to a teenage hacker known as Rey, based in Amman, Jordan. The FBI reports the group has extorted over $70 million this year alone, targeting sensitive government and corporate data. ## FBI Recruitment Site Breach In late September 2026, ShinyHunters compromised the FBI recruitment portal, fbijobs.gov. The attackers threatened to publish sensitive files, including psychological records, Social Security numbers, and home addresses of agency employees. This brazen act prompted the FBI to accelerate arrests and interrogations of individuals linked to the group’s leadership, including the detained hacker Rey. ## Dutch Arrests Uncover Evidence On September 15, 2026, Dutch police arrested suspect Pepijn van der Stap using flash-bang grenades. While he was logged into his Signal account, authorities captured critical communications. These messages revealed frequent discussions with ransomware negotiators in Canada and the U.S., providing a roadmap for investigators to unravel a complex murder-for-hire plot. ## Executive Arrest in Canada The FBI arrested 54-year-old Canadian cybersecurity executive Edward Dubrovsky on October 9. Charged with extortion and interfering with interstate commerce, Dubrovsky previously authored a book recommending engagement with hackers. Prosecutors have requested he remain in custody, as court records regarding his case currently remain under seal to protect the ongoing investigation. ## The Shinywire Extortion Platform Investigators believe a U.S.-based consulting firm executive actively operated the now-defunct Shinywire website. Active from May to October 2026, the site listed nearly 100 hacked organizations, including Intuitive Surgical. It provided samples of stolen files to coerce payments, serving as a centralized hub for the group's extortion demands against various global corporate entities. ## Internal Industry Conflicts Before his arrest, Edward Dubrovsky filed a lawsuit against Daniel Tobok, a former business partner and CEO of the cybersecurity firm Cypfer. Dubrovsky alleged a campaign to destroy his career, while Tobok filed a counterclaim accusing Dubrovsky of unfair competition. These internal disputes have surfaced as a focal point for federal investigators probing the group. ## The Ghostbyte Alias Connection Evidence suggests Daniel Tobok may have used the alias Ghostbyte, a name linked to the Russian-language ransomware program Dharma as early as 2018. A Dharma representative once directed a victim to contact a 'Ghostbyte' email address for payment guarantees. Digital forensics now link this alias to email accounts frequently used by Mr. Tobok. ## Corporate Stance on Payments Cypfer stated it does not facilitate ransomware payments and had no prior knowledge of Dubrovsky’s arrest. The company, recently acquired by Apros Group, maintains that it operates independently of other firms. Despite these claims, the investigation continues to scrutinize the blurred lines between incident response services and the facilitation of illegal ransom demands. ## The PowerSchool Breach Case In 2024, ShinyHunters extorted PowerSchool, stealing data on 62 million students and 9.5 million teachers. Although a $2.85 million ransom was paid with assistance from CyberSteward, the data was later abused in secondary extortion attempts. This case proves that paying hackers offers no guarantee that stolen information will be deleted or kept private. ## Industry Resistance to Extortion Leading incident response firms like Coveware and Unit 221B consistently advise against paying ShinyHunters. They warn that data is often resold or used for further extortion. ShinyHunters leaders have expressed significant frustration with these firms, even threatening employees at Coveware for providing advice that allegedly harms the group's ability to collect ransom payments. ## Implications for Cybersecurity Ethics The ShinyHunters case underscores the systemic risks when security professionals cross ethical boundaries to facilitate criminal extortion. As law enforcement tightens its grip on these networks, the industry faces a reckoning regarding the role of negotiators. The outcome of these trials will likely redefine legal standards for handling cyber extortion and corporate data breaches. ## Sources covering this story - https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._