U.S. national investigators following the ShinyHunters hacking collection that lately stole extremely delicate data from the FBI have identified executives at two distinct ransomware negotiation firms who maintained unusually near relations alongside the blackmail group, KrebsOnSecurity has learned. Sources near to the inquiry say among the executives in the United States equal helped ShinyHunters run a website that pressured victims into paying a ransom.
Hackers aligned alongside ShinyHunters have claimed credit for dozens of important data breaches since 2019, whenever the collection was chiefly operated by cybercriminals living in France. As those first members were arrested or jailed one by one, authority complete the ShinyHunters brand eventually passed to “Rey,” identified final year as a teenage hacker from Amman, Jordan. According to the FBI, ShinyHunters has extorted additional than $70 myriad from victims so far this year.
In delayed September, ShinyHunters hacked the FBI recruitment website fbijobs.gov and taunted the agency by threatening to publish the taken files, which reportedly included medicinal and mental records, Social Security numbers and residence addresses, and data concerning all employee’s component and specialization.
The FBI jobs location hack has prompted the agency to move alongside rare speed to arrest, detain and inquiry group who had any communications alongside Rey or another ShinyHunters suspects. Reuters reported on October 3 that Rey had been detained by Jordanian authorities and was cooperating alongside the FBI.
Rey was capable to assume authority complete the hacking collection since one of its alleged elder members had fair been nabbed. On the evening of September 15, 2026, authorities in the Netherlands arrested convicted hacker and ShinyHunters doubtful Pepijn van der Stap. Dutch constabulary reportedly used flash-bang grenades in an attempt to stun and apprehend Van der Stap as he was logged in to assorted online accounts.
According to a origin near to the investigation, the authorities arrested Van der Stap during he was using his Signal instant messaging account, which allowed them to peruse latest communications alongside common contacts — including ransomware negotiators based in Canada and the United States.
Multiple sources alongside cognition of the matter told KrebsOnSecurity that Van der Stap’s messages were the key to unraveling a murder-for-hire storyline that emerged immediately following his arrest. The Dutch news outlet RTL reported final duration the two murders were allegedly to be committed abroad, and that there are indications Van der Stap gave the command for the attacks (there is no sign those orders were always carried out).
On October 9, KrebsOnSecurity broke the news that the FBI arrested a 54-year-old Canadian cybersecurity administrator named Edward Dubrovsky in association alongside the ShinyHunters investigation. Dubrovsky, who lately published a book on handling cyber blackmail that recommended continually engaging alongside the hackers, was charged alongside threatening to disclose taken or hacked data and interfering alongside interstate commerce through extortion, according to court records. Politico reports prosecutors have asked that Dubrovsky remain in custody pending trial, and that records connected to his case remain under seal.
A origin near to the inquiry told KrebsOnSecurity that Van der Stap’s Signal messages showed he had common conversations alongside Mr. Dubrovsky and alongside at smallest one administrator at a ample U.S.-based consulting firm, and that these executives frequently knew the particulars concerning new ShinyHunters victims before the victims themselves had equal learned of the breach.
That origin shared another possibly bomb finding by national investigators: the Dutch hacker’s chats showed Mr. Dubrovsky knew ShinyHunters had taken extremely delicate data from FBI servers, and that he never informed the agency of the data breach previous to ShinyHunters threatening on Twitter/X to publish the agency’s deeply individual personnel files.
SHINYWIRE
KrebsOnSecurity has learned from two sources near to the ShinyHunters investigation that FBI investigators accept at smallest one administrator at a U.S.-based consulting resolute played an energetic function in functioning the now-defunct ShinyHunters casualty blackmail website “shinywire[.]com.” KrebsOnSecurity is not naming the U.S. business or the suspected executive(s) for now since they have not yet been charged alongside a crime, but it is a distinguished resolute alongside additional than 1,000 associates.
A division of the homepage for the now-defunct Shinywire website.
The Shinywire website was energetic from about May 3, 2026 until October 16 and had entries for nearly 100 organizations hacked by ShinyHunters. Each admission urged victims to affect alongside the cybercrime collection and conversation conditions for payment. The pages additionally included samples of taken records and promised those records would be published online if the casualty ignored their demands.
The following screenshot shows a cached portion of the Shinywire blackmail leaf for Intuitive Surgical, an American medicinal innovation business that was breached in March 2026 following an employee cut for a targeted phishing email.
The Shinywire website, as indexed by urlscan.io. This listing is an blackmail petition targeting Intuitive Surgical, an American medicinal innovation business damaged in March 2026 by a targeted phishing email assault that compromised an employee’s credentials.
Victim organizations that refused to affect or negotiate following seven days would discover all of their taken data published on the ShinyHunters casualty shaming blog (a website that is lone reachable via the anonymity network Tor).
In a narrative published October 15, The Globe and Mail wrote that a few months before Edward Dubrovsky was arrested by the FBI, the Canadian cybersecurity administrator alleged in court documents he had rotate into collateral damage in a run by a erstwhile endeavor partner to “destroy” another industry executive.
The narrative noted that Dubrovsky submitted the lawsuit in Ontario this twelvemonth against Daniel Tobok, the erstwhile chief administrator of Cypfer, a cybersecurity resolute founded in Toronto alongside offices in the U.S., Britain, the Netherlands, the United Arab Emirates, and Mexico. The two archetypal became endeavor partners in 2017 and afterward developed Cypfer together, anywhere Mr. Dubrovsky was a managing partner and chief functioning officer. But by 2024, the two had a falling out, alongside Dubrovsky accusing Tobok of gradually excluding him from endeavor matters and making “increasingly capricious endeavor decisions.”
Mr. Tobok reportedly denied the allegations and submitted a counterclaim, accusing Mr. Dubrovsky of accessing confidential data and unfairly competing alongside Cypfer through activity at another resolute called CyberSteward Inc. He additionally stated Mr. Dubrovsky has misrepresented himself as a Cypfer founder, and is not a shareholder.
GHOSTBYTE
According to interviews alongside multiple erstwhile colleagues of Mr. Tobok, as far rear as eight years ago he was known to ransomware purveyors by a particular nickname: Ghostbyte. In 2018, a Canadian business was hacked by Dharma, a prolific Russian-language ransomware affiliate program that archetypal surfaced in 2016. The casualty business told the Dharma ransomware delegate they were leaning toward paying since several of the records were unrecoverable following being locked, but that they needed a improved justify that Dharma would keep their term if paid.
A redacted copy of the Dharma rep’s answer is pictured below, and it shows the ransomware collection urged the casualty to communication a individual at a Canadian IT resolute that helps companies seeking specified guarantees. The Dharma rep recommended the casualty communication the email location [email protected].
“If you desire guarantees, you can compose to the IT company,” the Dharma answer advised. “Take the phone and negotiate alongside them. This IT business frequently solves specified problems in Canada. You can communication them and sign a agreement for services. You’ll motionless have to pay.”
An email answer from the Dharma ransomware collection to a victim, recommending they communication an email location that is connected to Mr. Tobok.
It’s unclear if Mr. Tobok always used that Ghostbyte location offered by the Dharma representative, and he has not responded to multiple requests for comment. However, the breach tracking assistance Constella Intelligence finds an email location Mr. Tobok has frequently used — [email protected] — is connected alongside two online accounts anywhere the chosen username was “ghostbyte,” including a Snapchat account.
Incidentally, Constella additionally finds the Dharma rep’s email location [email protected] is connected alongside a cryptocurrency address that processed 38 transactions totaling 43 bitcoin, ~$3.5 myriad at today’s value (the most latest transaction for this wallet is dated February 2019).
In a declaration shared on October 14, Cypfer stated the company’s endeavor does not contain making or facilitating ransomware payments, and that Cypfer learned of Dubrovsky’s apprehension whenever the news archetypal bankrupt in the media.
“We had no previous cognition of Mr. Dubrovsky’s arrest,” a spokesman told KrebsOnSecurity via email. “CYPFER has not received any outreach from law implementation and, to our knowledge, is not the mark of any law implementation investigation.”
The declaration stated CyberSteward and Cypfer are distinct companies alongside no officers, board or workforce in common, and that Cypfer was lately acquired by the Apros Group, a holding business led by Jason Hogg, a erstwhile FBI particular delegate and erstwhile CEO of Aon Cyber Solutions Group. In 2020, Aon aquired Cytelligence, a safety consulting resolute anywhere Mr. Tobok was originator and CEO and Mr. Dubrovsky was a managing partner.
CONFLICTING INTERESTS
It is not forbidden in the United States to pay hackers for an encryption key to unlock servers infected alongside ransomware, or in toggle for a commitment to delete any taken records and refrain from publishing them online. While casualty organizations can district in lawful hot h2o if they pay a ransom to a collection that is sanctioned by the U.S. Treasury Department, ShinyHunters is not among the ransomware groups currently sanctioned by the United States or by any another government.
Experts say ransomware victims are typically directed by their coverage provider to activity alongside a particular event reply firm. But not all cyber forensics and breach reply companies volition concur to facilitate payments to ransomware groups on behalf of their clients. As a result, formerly casualty firms create a decision to pay, the firms that eschew rewarding extortionists are invariably replaced by companies that have no specified qualms.
In December 2024, ShinyHunters began extorting the learning innovation business PowerSchool, stealing personal data on 62 myriad students and 9.5 myriad teachers in the U.S. and Canada. PowerSchool reportedly paid a $2.85 myriad ransom demand, and a “frequently asked questions” statement (PDF) concerning the breach says PowerSchool was assisted in that attempt by CyberSteward (ShinyHunters affiliate Matthew Lane, 20, of Sterling, Mass., was sentenced in November 2025 to four years in jail for his admitted function in the PowerSchool hack).
But that ransom fee did not halt forthcoming blackmail attempts using the identical taken data. By May 2025, idiosyncratic academy districts were reportedly receiving distinct ransom demands using samples of the identical taken files. While nobody has alleged ShinyHunters was rearward the second motion of blackmail against PowerSchool users, the event drives residence the actuality that there is no specialized way to verify the danger actors have deleted the taken data as promised, or forestall others from abusing the identical records.
A figure of foremost cyber event reply firms, including Coveware and Unit 221B, have consistently warned victims against paying ShinyHunters, noting that “destroyed” casualty data is frequently kept, resold or used to extort the company’s clients immediately afterward on.
The FBI echoed those sentiments in an alert on May 15, 2026 advising victims against paying the ShinyHunters group. Meanwhile, ShinyHunters members have been harassing and threatening workforce at Coveware and Unit 221B for offering this advice.
The following screenshots display fair how annoyed the ShinyHunters leaders were alongside Coveware’s relentless direction against paying the group. The archetypal depiction is from a conversation on May 6, 2026 that took location between the group’s chief document on Telegram and a co-conspirator. In that chat, snippets of which were shared alongside KrebsOnSecurity by a trusted source, ShinyHunters complained that Coveware was harming the group’s fee rates.
The controller of the ShinyHunters document on Telegram speaking privately alongside a co-conspirator and complaining that Coveware was harming their business.
“Go on my website, bulk of those companies would’ve paid if it weren’t for Coveware giving them misinformation,” the ShinyHunters document wrote. “Someone (100% Coveware) is going out of their way to create certain i am not paid.”
In another conversation on April 11, 2026, the ShinyHunters Telegram document privately stated they were trying to “eliminate the problem,” which they stated was Coveware. Coveware declined to comment for this story.
“I’m certain the business volition pay but in this particular case I am conscious of Coveware and their involvement, and I’ve likely been not getting a lot of another negotiations mostly apt since Coveware keeps getting involved,” the ShinyHunters document bemoaned.
The controller of the ShinyHunters document on Telegram telling a co-conspirator they were “trying to eliminate the problem,” which they identified as Coveware advising victims not to pay the cybercrime group.
Mark Camillo is chief administrator at CyberAcuView, an industry collection founded in 2021 by a consortium of important cyber coverage carriers. Camillo stated several firms accusation a flat retainer fee, during those that specialize in assisting companies negotiate a ransom fee lean to accusation a percent of the total ransom amount paid.
That second dynamic, he said, is an inherent battle of interest, as the negotiator has all incentive to create things additional favorable to the attackers since they are financially incentivized to negotiate and pay out, and to not negotiate downward on the price.
“It has arrive to the industry’s notice that many of the ransomware payers accusation a percent of the final fee which may or may not be disclosed,” Camillo said. “This makes no awareness if they are additionally the negotiator. There needs to be additional transparency in the procedure as no one in the ecosystem have to be profiting purely on the size of the ransomware transaction or fee itself.”
Camillo stated the firms doing this activity would contend the fees are needed since there may be unexpectedly higher expenses to safe larger quantities of cryptocurrency or additional hazard carrying the float, and since cryptocurrency exchanges may accusation higher fees for elevated hazard transactions.
“There certainly needs to be additional visibility about the transaction and clarity on the expanding value of the crypto and the exchange’s percent in the transaction to get to the base of this and eliminate any misaligned incentives,” he said.
In latest months, the U.S. Department of Justice has prosecuted a figure of ransomware negotiators alleged to have conspired alongside cybercriminals to defraud their clients. On October 7, the DOJ charged MonsterCloud CEO Zohar Pinhasi, 50, alongside cable fraud and conspiracy for allegedly charging customers to remediate ransomware attacks without paying the hackers. According to charging documents, Pinhasi secretly went rearward his customers’ backs and paid hackers anyway, paying ransomware groups $8 myriad during charging customers $19 million.
In July, Angelo Martino, a 41-year-old ransomware negotiator from Land O’Lakes, Florida, was sentenced to 70 months in prison for colluding alongside the Blackcat/ALPHV ransomware collection to extort multiple victims. According to the DOJ, Martino was paid by BlackCat attackers to provision confidential data concerning the negotiating stance and scheme of his employer’s clients and allow the ransomware actors to maximize the ransoms paid by the victims.
