U.S. federal investigators pursuing the ShinyHunters hacking group that lately stole extremely delicate information from the FBI have recognized executives at two completely different ransomware negotiation corporations who maintained unusually shut relations with the extortion group, KrebsOnSecurity has realized. Sources near the investigation say one of many executives in america even helped ShinyHunters function an internet site that pressured victims into paying a ransom.
Hackers aligned with ShinyHunters have claimed credit score for dozens of main information breaches since 2019, when the group was primarily operated by cybercriminals residing in France. As these unique members have been arrested or jailed one after the other, management over the ShinyHunters model ultimately handed to “Rey,” recognized final yr as a teenage hacker from Amman, Jordan. In line with the FBI, ShinyHunters has extorted greater than $70 million from victims to this point this yr.
In late September, ShinyHunters hacked the FBI recruitment web site fbijobs.gov and taunted the company by threatening to publish the stolen recordsdata, which reportedly included medical and psychological data, Social Safety numbers and residential addresses, and details about every worker’s unit and specialization.
The FBI jobs website hack has prompted the company to maneuver with unusual velocity to arrest, detain and query individuals who had any communications with Rey or different ShinyHunters suspects. Reuters reported on October 3 that Rey had been detained by Jordanian authorities and was cooperating with the FBI.
Rey was capable of assume management over the hacking group as a result of certainly one of its alleged senior members had simply been nabbed. On the night of September 15, 2026, authorities within the Netherlands arrested convicted hacker and ShinyHunters suspect Pepijn van der Stap. Dutch police reportedly used flash-bang grenades in an effort to stun and apprehend Van der Stap as he was logged in to varied on-line accounts.
In line with a supply near the investigation, the authorities arrested Van der Stap whereas he was utilizing his Sign on the spot messaging account, which allowed them to learn latest communications with frequent contacts — together with ransomware negotiators primarily based in Canada and america.
A number of sources with data of the matter instructed KrebsOnSecurity that Van der Stap’s messages have been the important thing to unraveling a murder-for-hire plot that emerged instantly following his arrest. The Dutch information outlet RTL reported final month the 2 murders have been allegedly to be dedicated overseas, and that there are indications Van der Stap gave the order for the assaults (there is no such thing as a indication these orders have been ever carried out).
On October 9, KrebsOnSecurity broke the information that the FBI arrested a 54-year-old Canadian cybersecurity government named Edward Dubrovsky in reference to the ShinyHunters investigation. Dubrovsky, who lately printed a ebook on dealing with cyber extortion that advisable at all times participating with the hackers, was charged with threatening to reveal stolen or hacked information and interfering with interstate commerce by means of extortion, in line with courtroom data. Politico experiences prosecutors have requested that Dubrovsky stay in custody pending trial, and that data associated to his case stay underneath seal.
A supply near the investigation instructed KrebsOnSecurity that Van der Stap’s Sign messages confirmed he had frequent conversations with Mr. Dubrovsky and with no less than one government at a big U.S.-based consulting agency, and that these executives typically knew the small print about new ShinyHunters victims earlier than the victims themselves had even realized of the breach.
That supply shared one other probably explosive discovering by federal investigators: the Dutch hacker’s chats confirmed Mr. Dubrovsky knew ShinyHunters had stolen extremely delicate information from FBI servers, and that he by no means knowledgeable the bureau of the info breach previous to ShinyHunters threatening on Twitter/X to publish the company’s deeply private personnel recordsdata.
SHINYWIRE
KrebsOnSecurity has realized from two sources near the ShinyHunters probe that FBI investigators consider no less than one government at a U.S.-based consulting agency performed an energetic position in working the now-defunct ShinyHunters sufferer extortion web site “shinywire[.]com.” KrebsOnSecurity is just not naming the U.S. firm or the suspected government(s) for now as a result of they haven’t but been charged with a criminal offense, however it’s a prestigious agency with greater than 1,000 associates.
A bit of the homepage for the now-defunct Shinywire web site.
The Shinywire web site was energetic from roughly Could 3, 2026 till October 16 and had entries for practically 100 organizations hacked by ShinyHunters. Every entry urged victims to have interaction with the cybercrime group and focus on phrases for cost. The pages additionally included samples of stolen recordsdata and promised these recordsdata can be printed on-line if the sufferer ignored their calls for.
The next screenshot exhibits a cached portion of the Shinywire extortion web page for Intuitive Surgical, an American medical expertise firm that was breached in March 2026 after an worker fell for a focused phishing e mail.
The Shinywire web site, as listed by urlscan.io. This itemizing is an extortion demand concentrating on Intuitive Surgical, an American medical expertise firm breached in March 2026 by a focused phishing e mail assault that compromised an worker’s credentials.
Sufferer organizations that refused to have interaction or negotiate after seven days would discover all of their stolen information printed on the ShinyHunters sufferer shaming weblog (an internet site that’s solely reachable by way of the anonymity community Tor).
In a narrative printed October 15, The Globe and Mail wrote that a number of months earlier than Edward Dubrovsky was arrested by the FBI, the Canadian cybersecurity government alleged in courtroom paperwork he had change into collateral harm in a marketing campaign by a former enterprise accomplice to “destroy” one other trade government.
The story famous that Dubrovsky filed the lawsuit in Ontario this yr in opposition to Daniel Tobok, the previous chief government of Cypfer, a cybersecurity agency based in Toronto with workplaces within the U.S., Britain, the Netherlands, the United Arab Emirates, and Mexico. The 2 first grew to become enterprise companions in 2017 and later developed Cypfer collectively, the place Mr. Dubrovsky was a managing accomplice and chief working officer. However by 2024, the 2 had a falling out, with Dubrovsky accusing Tobok of step by step excluding him from enterprise issues and making “more and more capricious enterprise choices.”
Mr. Tobok reportedly denied the allegations and filed a counterclaim, accusing Mr. Dubrovsky of accessing confidential data and unfairly competing with Cypfer by means of work at one other agency referred to as CyberSteward Inc. He additionally mentioned Mr. Dubrovsky has misrepresented himself as a Cypfer founder, and isn’t a shareholder.
GHOSTBYTE
In line with interviews with a number of former colleagues of Mr. Tobok, way back to eight years in the past he was identified to ransomware purveyors by a selected nickname: Ghostbyte. In 2018, a Canadian firm was hacked by Dharma, a prolific Russian-language ransomware associates program that first surfaced in 2016. The sufferer firm instructed the Dharma ransomware consultant they have been leaning towards paying as a result of among the recordsdata have been unrecoverable after being locked, however that they wanted a greater assure that Dharma would preserve their phrase if paid.
A redacted copy of the Dharma rep’s reply is pictured under, and it exhibits the ransomware group urged the sufferer to contact an individual at a Canadian IT agency that helps firms in search of such ensures. The Dharma rep advisable the sufferer contact the e-mail handle ghostbyte@tutanota.com.
“If you need ensures, you possibly can write to the IT firm,” the Dharma reply suggested. “Take the cellphone and negotiate with them. This IT firm typically solves such issues in Canada. You’ll be able to contact them and signal a contract for companies. You’ll nonetheless should pay.”
An e mail reply from the Dharma ransomware group to a sufferer, recommending they contact an e mail handle that’s related to Mr. Tobok.
It’s unclear if Mr. Tobok ever used that Ghostbyte handle provided by the Dharma consultant, and he has not responded to a number of requests for remark. Nonetheless, the breach monitoring service Constella Intelligence finds an e mail handle Mr. Tobok has often used — dtobok@me.com — is related to two on-line accounts the place the chosen username was “ghostbyte,” together with a Snapchat account.
By the way, Constella additionally finds the Dharma rep’s e mail handle luckygoodlucky@tuta.io is related to a cryptocurrency handle that processed 38 transactions totaling 43 bitcoin, ~$3.5 million at immediately’s worth (the newest transaction for this pockets is dated February 2019).
In an announcement shared on October 14, Cypfer mentioned the corporate’s enterprise doesn’t embrace making or facilitating ransomware funds, and that Cypfer realized of Dubrovsky’s arrest when the information first broke within the media.
“We had no prior data of Mr. Dubrovsky’s arrest,” a spokesperson instructed KrebsOnSecurity by way of e mail. “CYPFER has not acquired any outreach from legislation enforcement and, to our data, is just not the goal of any legislation enforcement investigation.”
The assertion mentioned CyberSteward and Cypfer are separate firms with no officers, administrators or workers in widespread, and that Cypfer was lately acquired by the Apros Group, a holding firm led by Jason Hogg, a former FBI particular agent and former CEO of Aon Cyber Options Group. In 2020, Aon aquired Cytelligence, a safety consulting agency the place Mr. Tobok was founder and CEO and Mr. Dubrovsky was a managing accomplice.
CONFLICTING INTERESTS
It isn’t unlawful in america to pay hackers for an encryption key to unlock servers contaminated with ransomware, or in trade for a promise to delete any stolen recordsdata and chorus from publishing them on-line. Whereas sufferer organizations can land in authorized scorching water in the event that they pay a ransom to a bunch that’s sanctioned by the U.S. Treasury Division, ShinyHunters is just not among the many ransomware teams at the moment sanctioned by america or by another authorities.
Consultants say ransomware victims are usually directed by their insurance coverage supplier to work with a particular incident response agency. However not all cyber forensics and breach response firms will conform to facilitate funds to ransomware teams on behalf of their purchasers. In consequence, as soon as sufferer corporations decide to pay, the corporations that eschew rewarding extortionists are invariably changed by firms that don’t have any such qualms.
In December 2024, ShinyHunters started extorting the schooling expertise firm PowerSchool, stealing personal data on 62 million college students and 9.5 million academics within the U.S. and Canada. PowerSchool reportedly paid a $2.85 million ransom demand, and a “often requested questions” assertion (PDF) in regards to the breach says PowerSchool was assisted in that effort by CyberSteward (ShinyHunters affiliate Matthew Lane, 20, of Sterling, Mass., was sentenced in November 2025 to 4 years in jail for his admitted position within the PowerSchool hack).
However that ransom cost didn’t cease future extortion makes an attempt utilizing the identical stolen information. By Could 2025, particular person faculty districts have been reportedly receiving separate ransom calls for utilizing samples of the identical stolen recordsdata. Whereas no one has alleged ShinyHunters was behind the second wave of extortion in opposition to PowerSchool customers, the incident drives house the truth that there is no such thing as a technical technique to confirm the risk actors have deleted the stolen information as promised, or forestall others from abusing the identical data.
A lot of main cyber incident response corporations, together with Coveware and Unit 221B, have constantly warned victims in opposition to paying ShinyHunters, noting that “destroyed” sufferer information is usually saved, resold or used to extort the corporate’s purchasers instantly in a while.
The FBI echoed these sentiments in an alert on Could 15, 2026 advising victims in opposition to paying the ShinyHunters group. In the meantime, ShinyHunters members have been harassing and threatening workers at Coveware and Unit 221B for providing this recommendation.
The next screenshots present simply how irritated the ShinyHunters leaders have been with Coveware’s relentless recommendation in opposition to paying the group. The primary picture is from a dialog on Could 6, 2026 that occurred between the group’s principal account on Telegram and a co-conspirator. In that chat, snippets of which have been shared with KrebsOnSecurity by a trusted supply, ShinyHunters complained that Coveware was harming the group’s cost charges.
The operator of the ShinyHunters account on Telegram talking privately with a co-conspirator and complaining that Coveware was harming their enterprise.
“Go on my web site, majority of these firms would’ve paid if it weren’t for Coveware giving them misinformation,” the ShinyHunters account wrote. “Somebody (100% Coveware) goes out of their means to verify i’m not paid.”
In one other dialog on April 11, 2026, the ShinyHunters Telegram account privately mentioned they have been making an attempt to “eradicate the issue,” which they mentioned was Coveware. Coveware declined to remark for this story.
“I’m positive the corporate pays however on this particular case I’m conscious of Coveware and their involvement, and I’ve in all probability been not getting a variety of different negotiations principally probably as a result of Coveware retains getting concerned,” the ShinyHunters account bemoaned.
The operator of the ShinyHunters account on Telegram telling a co-conspirator they have been “making an attempt to eradicate the issue,” which they recognized as Coveware advising victims to not pay the cybercrime group.
Mark Camillo is chief government at CyberAcuView, an trade group based in 2021 by a consortium of main cyber insurance coverage carriers. Camillo mentioned some corporations cost a flat retainer price, whereas these focusing on serving to firms negotiate a ransom cost are inclined to cost a proportion of the full ransom quantity paid.
That latter dynamic, he mentioned, is an inherent battle of curiosity, because the negotiator has each incentive to make issues extra favorable to the attackers as a result of they’re financially incentivized to barter and pay out, and to not negotiate down on the worth.
“It has come to the trade’s consideration that lots of the ransomware payers cost a proportion of the ultimate cost which can or might not be disclosed,” Camillo mentioned. “This is mindless if they’re additionally the negotiator. There must be extra transparency within the course of as nobody within the ecosystem needs to be profiting purely on the dimensions of the ransomware transaction or cost itself.”
Camillo mentioned the corporations doing this work would argue the charges are wanted as a result of there could also be unexpectedly larger prices to safe bigger portions of cryptocurrency or extra danger carrying the float, and since cryptocurrency exchanges could cost larger charges for top danger transactions.
“There undoubtedly must be extra visibility across the transaction and readability on the rising worth of the crypto and the trade’s p.c within the transaction to unravel this and take away any misaligned incentives,” he mentioned.
In latest months, the U.S. Division of Justice has prosecuted plenty of ransomware negotiators alleged to have conspired with cybercriminals to defraud their purchasers. On October 7, the DOJ charged MonsterCloud CEO Zohar Pinhasi, 50, with wire fraud and conspiracy for allegedly charging prospects to remediate ransomware assaults with out paying the hackers. In line with charging paperwork, Pinhasi secretly went behind his prospects’ backs and paid hackers anyway, paying ransomware teams $8 million whereas charging prospects $19 million.
In July, Angelo Martino, a 41-year-old ransomware negotiator from Land O’Lakes, Florida, was sentenced to 70 months in jail for conspiring with the Blackcat/ALPHV ransomware group to extort a number of victims. In line with the DOJ, Martino was paid by BlackCat attackers to offer confidential details about the negotiating place and technique of his employer’s purchasers and allow the ransomware actors to maximise the ransoms paid by the victims.
