Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Website – Krebs on Security

U.S. federal investigators pursuing the ShinyHunters hacking group that just lately stole extremely delicate knowledge from the FBI have recognized executives at two totally different ransomware negotiation companies who maintained unusually shut relations with the extortion group, KrebsOnSecurity has realized. Sources near the investigation say one of many executives within the United States even helped ShinyHunters function a web site that pressured victims into paying a ransom.

Hackers aligned with ShinyHunters have claimed credit score for dozens of main knowledge breaches since 2019, when the group was primarily operated by cybercriminals dwelling in France. As these unique members had been arrested or jailed one after the other, management over the ShinyHunters model finally handed to “Rey,” identified last year as a teenage hacker from Amman, Jordan. According to the FBI, ShinyHunters has extorted greater than $70 million from victims to this point this yr.

In late September, ShinyHunters hacked the FBI recruitment web site fbijobs.gov and taunted the company by threatening to publish the stolen information, which reportedly included medical and psychological information, Social Security numbers and residential addresses, and details about every worker’s unit and specialization.

The FBI jobs web site hack has prompted the company to maneuver with unusual pace to arrest, detain and query individuals who had any communications with Rey or different ShinyHunters suspects. Reuters reported on October 3 that Rey had been detained by Jordanian authorities and was cooperating with the FBI.

Rey was in a position to assume management over the hacking group as a result of certainly one of its alleged senior members had simply been nabbed. On the night of September 15, 2026, authorities within the Netherlands arrested convicted hacker and ShinyHunters suspect Pepijn van der Stap. Dutch police reportedly used flash-bang grenades in an effort to stun and apprehend Van der Stap as he was logged in to varied on-line accounts.

According to a supply near the investigation, the authorities arrested Van der Stap whereas he was utilizing his Signal prompt messaging account, which allowed them to learn latest communications with frequent contacts — together with ransomware negotiators primarily based in Canada and the United States.

Multiple sources with data of the matter instructed KrebsOnSecurity that Van der Stap’s messages had been the important thing to unraveling a murder-for-hire plot that emerged instantly following his arrest. The Dutch information outlet RTL reported final month the 2 murders had been allegedly to be dedicated overseas, and that there are indications Van der Stap gave the order for the assaults (there isn’t any indication these orders had been ever carried out).

On October 9, KrebsOnSecurity broke the news that the FBI arrested a 54-year-old Canadian cybersecurity govt named Edward Dubrovsky in reference to the ShinyHunters investigation. Dubrovsky, who just lately published a book on dealing with cyber extortion that beneficial at all times partaking with the hackers, was charged with threatening to reveal stolen or hacked knowledge and interfering with interstate commerce via extortion, in keeping with court records. Politico reports prosecutors have requested that Dubrovsky stay in custody pending trial, and that information associated to his case stay beneath seal.

A supply near the investigation instructed KrebsOnSecurity that Van der Stap’s Signal messages confirmed he had frequent conversations with Mr. Dubrovsky and with at the least one govt at a big U.S.-based consulting agency, and that these executives typically knew the main points about new ShinyHunters victims earlier than the victims themselves had even realized of the breach.

That supply shared one other probably explosive discovering by federal investigators: the Dutch hacker’s chats confirmed Mr. Dubrovsky knew ShinyHunters had stolen extremely delicate knowledge from FBI servers, and that he by no means knowledgeable the bureau of the info breach previous to ShinyHunters threatening on Twitter/X to publish the company’s deeply private personnel information.

SHINYWIRE

KrebsOnSecurity has realized from two sources near the ShinyHunters probe that FBI investigators imagine at the least one govt at a U.S.-based consulting agency performed an energetic function in working the now-defunct ShinyHunters sufferer extortion web site “shinywire[.]com.” KrebsOnSecurity just isn’t naming the U.S. firm or the suspected govt(s) for now as a result of they haven’t but been charged with a criminal offense, however it’s a prestigious agency with greater than 1,000 associates.

The Shinywire web site was energetic from roughly May 3, 2026 till October 16 and had entries for practically 100 organizations hacked by ShinyHunters. Each entry urged victims to have interaction with the cybercrime group and talk about phrases for fee. The pages additionally included samples of stolen information and promised these information could be revealed on-line if the sufferer ignored their calls for.

The following screenshot exhibits a cached portion of the Shinywire extortion web page for Intuitive Surgical, an American medical know-how firm that was breached in March 2026 after an worker fell for a focused phishing e mail.

Victim organizations that refused to have interaction or negotiate after seven days would discover all of their stolen knowledge revealed on the ShinyHunters sufferer shaming weblog (a web site that’s solely reachable by way of the anonymity community Tor).

In a narrative revealed October 15, The Globe and Mail wrote that just a few months earlier than Edward Dubrovsky was arrested by the FBI, the Canadian cybersecurity govt alleged in courtroom paperwork he had turn into collateral harm in a marketing campaign by a former enterprise companion to “destroy” one other trade govt.

The story famous that Dubrovsky filed the lawsuit in Ontario this yr towards Daniel Tobok, the previous chief govt of Cypfer, a cybersecurity agency based in Toronto with places of work within the U.S., Britain, the Netherlands, the United Arab Emirates, and Mexico. The two first grew to become enterprise companions in 2017 and later developed Cypfer collectively, the place Mr. Dubrovsky was a managing companion and chief working officer. But by 2024, the 2 had a falling out, with Dubrovsky accusing Tobok of step by step excluding him from enterprise issues and making “more and more capricious enterprise choices.”

Mr. Tobok reportedly denied the allegations and filed a counterclaim, accusing Mr. Dubrovsky of accessing confidential data and unfairly competing with Cypfer via work at one other agency referred to as CyberSteward Inc. He additionally mentioned Mr. Dubrovsky has misrepresented himself as a Cypfer founder, and isn’t a shareholder.

GHOSTBYTE

According to interviews with a number of former colleagues of Mr. Tobok, way back to eight years in the past he was recognized to ransomware purveyors by a selected nickname: Ghostbyte. In 2018, a Canadian firm was hacked by Dharma, a prolific Russian-language ransomware associates program that first surfaced in 2016. The sufferer firm instructed the Dharma ransomware consultant they had been leaning towards paying as a result of a number of the information had been unrecoverable after being locked, however that they wanted a greater assure that Dharma would preserve their phrase if paid.

A redacted copy of the Dharma rep’s reply is pictured under, and it exhibits the ransomware group urged the sufferer to contact an individual at a Canadian IT agency that helps firms looking for such ensures. The Dharma rep beneficial the sufferer contact the e-mail tackle [email protected].

“If you need ensures, you may write to the IT firm,” the Dharma reply suggested. “Take the telephone and negotiate with them. This IT firm typically solves such issues in Canada. You can contact them and signal a contract for companies. You’ll nonetheless need to pay.”

It’s unclear if Mr. Tobok ever used that Ghostbyte tackle supplied by the Dharma consultant, and he has not responded to a number of requests for remark. However, the breach monitoring service Constella Intelligence finds an e mail tackle Mr. Tobok has ceaselessly used — [email protected] — is related to two on-line accounts the place the chosen username was “ghostbyte,” together with a Snapchat account.

Incidentally, Constella additionally finds the Dharma rep’s e mail tackle [email protected] is related to a cryptocurrency address that processed 38 transactions totaling 43 bitcoin, ~$3.5 million at in the present day’s worth (the newest transaction for this pockets is dated February 2019).

In an announcement shared on October 14, Cypfer mentioned the corporate’s enterprise doesn’t embrace making or facilitating ransomware funds, and that Cypfer realized of Dubrovsky’s arrest when the information first broke within the media.

“We had no prior data of Mr. Dubrovsky’s arrest,” a spokesperson instructed KrebsOnSecurity by way of e mail. “CYPFER has not acquired any outreach from regulation enforcement and, to our data, just isn’t the goal of any regulation enforcement investigation.”

The assertion mentioned CyberSteward and Cypfer are separate firms with no officers, administrators or staff in frequent, and that Cypfer was just lately acquired by the Apros Group, a holding firm led by Jason Hogg, a former FBI particular agent and former CEO of Aon Cyber Solutions Group. In 2020, Aon aquired Cytelligence, a safety consulting agency the place Mr. Tobok was founder and CEO and Mr. Dubrovsky was a managing companion.

CONFLICTING INTERESTS

It just isn’t unlawful within the United States to pay hackers for an encryption key to unlock servers contaminated with ransomware, or in alternate for a promise to delete any stolen information and chorus from publishing them on-line. While sufferer organizations can land in authorized scorching water in the event that they pay a ransom to a bunch that’s sanctioned by the U.S. Treasury Department, ShinyHunters just isn’t among the many ransomware teams at present sanctioned by the United States or by another authorities.

Experts say ransomware victims are sometimes directed by their insurance coverage supplier to work with a selected incident response agency. But not all cyber forensics and breach response firms will conform to facilitate funds to ransomware teams on behalf of their shoppers. As a consequence, as soon as sufferer companies decide to pay, the companies that eschew rewarding extortionists are invariably changed by firms that haven’t any such qualms.

In December 2024, ShinyHunters started extorting the schooling know-how firm PowerSchool, stealing non-public data on 62 million college students and 9.5 million lecturers within the U.S. and Canada. PowerSchool reportedly paid a $2.85 million ransom demand, and a “frequently asked questions” statement (PDF) in regards to the breach says PowerSchool was assisted in that effort by CyberSteward (ShinyHunters affiliate Matthew Lane, 20, of Sterling, Mass., was sentenced in November 2025 to 4 years in jail for his admitted function within the PowerSchool hack).

But that ransom fee didn’t cease future extortion makes an attempt utilizing the identical stolen knowledge. By May 2025, particular person faculty districts had been reportedly receiving separate ransom calls for utilizing samples of the identical stolen information. While no one has alleged ShinyHunters was behind the second wave of extortion towards PowerSchool customers, the incident drives dwelling the fact that there isn’t any technical approach to confirm the menace actors have deleted the stolen knowledge as promised, or stop others from abusing the identical information.

Quite a few main cyber incident response companies, together with Coveware and Unit 221B, have consistently warned victims against paying ShinyHunters, noting that “destroyed” sufferer knowledge is commonly saved, resold or used to extort the corporate’s shoppers immediately afterward.

The FBI echoed these sentiments in an alert on May 15, 2026 advising victims towards paying the ShinyHunters group. Meanwhile, ShinyHunters members have been harassing and threatening staff at Coveware and Unit 221B for providing this recommendation.

The following screenshots present simply how aggravated the ShinyHunters leaders had been with Coveware’s relentless recommendation towards paying the group. The first picture is from a dialog on May 6, 2026 that came about between the group’s foremost account on Telegram and a co-conspirator. In that chat, snippets of which had been shared with KrebsOnSecurity by a trusted supply, ShinyHunters complained that Coveware was harming the group’s fee charges.

“Go on my web site, majority of these firms would’ve paid if it weren’t for Coveware giving them misinformation,” the ShinyHunters account wrote. “Someone (100% Coveware) goes out of their manner to verify i’m not paid.”

In one other dialog on April 11, 2026, the ShinyHunters Telegram account privately mentioned they had been making an attempt to “eradicate the issue,” which they mentioned was Coveware. Coveware declined to remark for this story.

“I’m certain the corporate pays however on this particular case I’m conscious of Coveware and their involvement, and I’ve most likely been not getting numerous different negotiations principally possible as a result of Coveware retains getting concerned,” the ShinyHunters account bemoaned.

Mark Camillo is chief govt at CyberAcuView, an trade group based in 2021 by a consortium of main cyber insurance coverage carriers. Camillo mentioned some companies cost a flat retainer price, whereas these specializing in serving to firms negotiate a ransom fee are inclined to cost a proportion of the entire ransom quantity paid.

That latter dynamic, he mentioned, is an inherent clash of curiosity, because the negotiator has each incentive to make issues extra favorable to the attackers as a result of they’re financially incentivized to barter and pay out, and to not negotiate down on the value.

“It has come to the trade’s consideration that most of the ransomware payers cost a proportion of the ultimate fee which can or might not be disclosed,” Camillo mentioned. “This is mindless if they’re additionally the negotiator. There must be extra transparency within the course of as nobody within the ecosystem must be profiting purely on the dimensions of the ransomware transaction or fee itself.”

Camillo mentioned the companies doing this work would argue the charges are wanted as a result of there could also be unexpectedly increased prices to safe bigger portions of cryptocurrency or extra danger carrying the float, and since cryptocurrency exchanges could cost increased charges for prime danger transactions.

“There positively must be extra visibility across the transaction and readability on the growing worth of the crypto and the alternate’s % within the transaction to resolve this and take away any misaligned incentives,” he mentioned.

In latest months, the U.S. Department of Justice has prosecuted a variety of ransomware negotiators alleged to have conspired with cybercriminals to defraud their shoppers. On October 7, the DOJ charged MonsterCloud CEO Zohar Pinhasi, 50, with wire fraud and conspiracy for allegedly charging prospects to remediate ransomware assaults with out paying the hackers. According to charging paperwork, Pinhasi secretly went behind his prospects’ backs and paid hackers anyway, paying ransomware teams $8 million whereas charging prospects $19 million.

In July, Angelo Martino, a 41-year-old ransomware negotiator from Land O’Lakes, Florida, was sentenced to 70 months in prison for conspiring with the Blackcat/ALPHV ransomware group to extort a number of victims. According to the DOJ, Martino was paid by BlackCat attackers to supply confidential details about the negotiating place and technique of his employer’s shoppers and allow the ransomware actors to maximise the ransoms paid by the victims.