Feds Suspect Ransom Negotiator Helped ShinyHunters Run Extortion Site
Summary
KrebsOnSecurity reports that investigators suspect a U.S. consulting executive helped ShinyHunters operate its extortion site. Messages from an arrested hacker allegedly linked ransomware negotiators to the group; the claims remain under investigation.
Key points
- Sources say federal investigators believe an executive at a U.S.-based consulting firm helped operate ShinyHunters’ now-defunct extortion site, shinywire[.]com. The executive has not been charged.
- Shinywire was active from about May 3 to October 16, 2026, and listed nearly 100 organizations, with stolen-file samples and threats to publish victims’ data if they did not engage within seven days.
- The FBI arrested Canadian cybersecurity executive Edward Dubrovsky on October 9. Court records say he was charged with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion.
- Sources allege messages recovered from Dutch authorities’ arrest of Pepijn van der Stap showed frequent contact with Dubrovsky and another executive, and that Dubrovsky knew ShinyHunters had stolen sensitive FBI data.
- The FBI recruitment-site breach reportedly exposed sensitive personnel information, including medical and psychological records, Social Security numbers, and home addresses.
- An industry group executive said negotiators paid a percentage of the ransom may have a conflict of interest, and called for more transparency around fees and transactions.
Article Details
- Event Type
- U.S. federal investigation into alleged links between ransomware negotiators and ShinyHunters, including arrests and an alleged role in operating the group's extortion website.
- Impact
- ShinyHunters allegedly stole highly sensitive data from FBI servers, including personnel records, and threatened to publish it. Its now-defunct Shinywire extortion site listed nearly 100 organizations and threatened publication of stolen files. The article reports that investigators suspect a U.S.-based consulting-firm executive helped operate the site; that executive has not been named or charged. The article also reports arrests and prosecutions of ransomware negotiators in related matters.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | shinywire[.]com | Defunct ShinyHunters victim-extortion website that listed hacked organizations and threatened to publish stolen data. |
luckygoodlucky@tuta[.]io | Email address attributed in the article to a Dharma ransomware representative who advised a victim during a ransom negotiation. |
People
Angelo MartinoRansomware negotiator sentenced for conspiring with BlackCat attackers; the DOJ said he provided confidential client negotiating information to help maximize ransoms.Daniel TobokFormer Cypfer chief executive accused by Edward Dubrovsky in a lawsuit of business misconduct; Tobok denied the allegations and filed a counterclaim. The article also reports former colleagues associated him with the nickname Ghostbyte.Edward DubrovskyCanadian cybersecurity executive arrested by the FBI in connection with the ShinyHunters investigation and charged with threatening to disclose stolen or hacked data and extortion-related offenses, according to the article.Mark CamilloCyberAcuView chief executive who commented on potential conflicts of interest when negotiators charge fees tied to ransom payments.Matthew LaneIdentified in the article as a ShinyHunters affiliate who was sentenced for his admitted role in the PowerSchool hack.Pepijn van der StapConvicted hacker and ShinyHunters suspect arrested in the Netherlands; sources cited by the article say his communications helped investigators identify contacts and investigate related allegations.ReyTeenage hacker from Amman, Jordan, identified in the article as having taken control of the ShinyHunters brand; Reuters reportedly said he was detained by Jordanian authorities and cooperating with the FBI.Zohar PinhasiMonsterCloud CEO charged with wire fraud and conspiracy; the article says prosecutors allege he secretly paid hackers while charging customers for ransomware remediation.
Threat Actors
BlackCatRansomware group whose attackers were reported to have conspired with negotiator Angelo Martino to extort victims.DharmaRansomware affiliate program whose representative communicated with a victim and recommended a negotiation contact, according to the article.ShinyHuntersRansomware and extortion group linked in the article to data theft, victim extortion, and the Shinywire extortion site.
Vendors
CovewareA number of leading cyber incident response firms, including Coveware and Unit 221B, have consistently warned victims against paying ShinyHunters, noting that “destroyed” victim data is often kept, resold or used toCyberStewardDubrovsky of accessing confidential information and unfairly competing with Cypfer through work at another firm called CyberSteward Inc.CYPFERthat Dubrovsky filed the lawsuit in Ontario this year against Daniel Tobok, the former chief executive of Cypfer, a cybersecurity firm founded in Toronto with offices in the U.S., Britain, the Netherlands, the UnitedMonsterCloudOn October 7, the DOJ charged MonsterCloud CEO Zohar Pinhasi, 50, with wire fraud and conspiracy for allegedly charging customers to remediate ransomware attacks without paying the hackers.Unit 221BA number of leading cyber incident response firms, including Coveware and Unit 221B, have consistently warned victims against paying ShinyHunters, noting that “destroyed” victim data is often kept, resold or used to
Products
PowerSchoolIn December 2024, ShinyHunters began extorting the education technology company PowerSchool, stealing private information on 62 million students and 9.5 million teachers in the U.S.Signalto a source close to the investigation, the authorities arrested Van der Stap while he was using his Signal instant messaging account, which allowed them to read recent communications with frequent contacts —TelegramThe first image is from a conversation on May 6, 2026 that took place between the group’s main account on Telegram and a co-conspirator.Twitterservers, and that he never informed the bureau of the data breach prior to ShinyHunters threatening on Twitter/X to publish the agency’s deeply personal personnel files.
Countries
Canadathem to read recent communications with frequent contacts — including ransomware negotiators based in Canada and the United States.FranceHackers aligned with ShinyHunters have claimed credit for dozens of major data breaches since 2019, when the group was primarily operated by cybercriminals living in France.JordanAs those original members were arrested or jailed one by one, control over the ShinyHunters brand eventually passed to “Rey,” identified last year as a teenage hacker from Amman, Jordan.NetherlandsOn the evening of September 15, 2026, authorities in the Netherlands arrested convicted hacker and ShinyHunters suspect Pepijn van der Stap.United StatesSources close to the investigation say one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom.
Industries
CybersecurityOn October 9, KrebsOnSecurity broke the news that the FBI arrested a 54-year-old Canadian cybersecurity executive named Edward Dubrovsky in connection with the ShinyHunters investigation.Education technologyIn December 2024, ShinyHunters began extorting the education technology company PowerSchool, stealing private information on 62 million students and 9.5 million teachers in the U.S.medical technologyshows a cached portion of the Shinywire extortion page for Intuitive Surgical, an American medical technology company that was breached in March 2026 after an employee fell for a targeted phishing email.