WASHINGTON — U.S. federal investigators pursuing the notorious ShinyHunters cybercrime syndicate—which recently breached and leaked highly sensitive personnel data from the FBI—have uncovered a shadowy nexus of complicity within the cybersecurity industry. According to sources close to the federal investigation, authorities have identified executives at two separate ransomware negotiation firms who maintained unusually close, illicit ties to the extortion group.
In one of the most explosive developments in recent cybercrime history, sources report that a U.S.-based consulting executive allegedly helped ShinyHunters operate a public extortion website designed to pressure breached companies into paying multimillion-dollar ransoms.
The widening federal probe exposes an underbelly of the cyber-incident response industry, where the lines between defender and extortionist have increasingly blurred. As prosecutors crack down on rogue negotiators who exploit structural loopholes for financial gain, the fallout threatens to upend how organizations handle cyber extortion worldwide.
Main Facts: The FBI Breach and the Corporate Insider Threat
The current federal investigation accelerated dramatically following a series of high-profile cyberattacks attributed to ShinyHunters. Operating under the administrative control of a Jordanian teenager known online as “Rey”, the syndicate has amassed an estimated $70 million in extortion payments throughout the year.
In late September, the group launched a brazen assault on the FBI’s recruitment portal, fbijobs.gov. The hackers taunted law enforcement by threatening to publish sensitive internal records, including:
Psychological and medical evaluations of prospective and current personnel
Social Security numbers and residential addresses
Detailed assignments regarding employee specializations and units
This direct assault on federal infrastructure triggered an aggressive law enforcement response. Working internationally, authorities tracked down key syndicate members, leading to the arrest of convicted Dutch hacker Pepijn van der Stap in the Netherlands on September 15, and the subsequent detention of "Rey" in Jordan, where he began cooperating with the FBI.
However, the real shockwaves hit the corporate cybersecurity community on October 9, when the FBI arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive. Dubrovsky, who recently authored a book advising companies to always engage with cyber extortionists, was charged with threatening to disclose hacked data and interfering with interstate commerce through extortion.
According to federal investigators analyzing seized communications, Dubrovsky and executives at other consulting firms were not merely neutral intermediaries; they allegedly possessed insider knowledge of breaches—including the FBI network intrusion—long before the victims themselves were aware, choosing to withhold this information from authorities.
Chronology of an International Manhunt
To understand how federal investigators unraveled the network, one must trace the timeline of key arrests and digital footprints:
2019–2024: ShinyHunters rises to prominence, originally operating out of France. Following the arrests of early members, control transitions to new leadership, eventually falling to "Rey" and his associates, who orchestrate massive corporate data thefts, including a December 2024 breach of education tech giant PowerSchool affecting over 70 million individuals.
May 3, 2026: The domain shinywire[.]com goes live. Prosecutors allege that executives at a prestigious U.S.-based consulting firm actively helped operate the site, which listed nearly 100 corporate victims to force ransom payouts.
September 15, 2026: Dutch police execute a dramatic raid using flash-bang grenades to capture Pepijn van der Stap while he is actively logged into his Signal messaging accounts.
Late September 2026: ShinyHunters hacks fbijobs.gov, releasing personal records of federal applicants and employees.
October 3, 2026: Reuters reports that "Rey" has been detained in Amman, Jordan, and is cooperating with the FBI.
October 7, 2026: The U.S. Department of Justice charges MonsterCloud CEO Zohar Pinhasi with wire fraud for secretly paying hackers behind his clients’ backs while artificially inflating remediation bills.
October 9, 2026: The FBI arrests Edward Dubrovsky in connection with the ShinyHunters probe. Court records reveal charges of extortion and data disclosure threats.
October 16, 2026: The shinywire.com extortion portal goes offline following international law enforcement pressure.
Supporting Data: The Anatomy of shinywire.com and the "Ghostbyte" Alias
The centerpiece of the federal government’s case regarding corporate complicity centers on Shinywire. Active from May 3 until mid-October 2026, the platform functioned as a centralized shaming and pressure mechanism for the cybercrime syndicate.
Investigators discovered that nearly 100 organizations breached by ShinyHunters were featured on the site. Each entry gave victims a strict seven-day window to negotiate and pay, accompanied by samples of stolen proprietary data. If a victim refused, their entire database was published on the syndicate’s Tor-based dark web blog. Notable victims included American medical technology firm Intuitive Surgical, which suffered a credential-stuffing phishing attack in March 2026.
The "Ghostbyte" Connection
As investigators dug deeper into historical ransomware vectors, past digital identities resurfaced. Interviews with former colleagues of Daniel Tobok—former CEO of cybersecurity firm Cypfer—revealed that as far back as 2018, Tobok was known to affiliates of the Dharma ransomware strain by the moniker "Ghostbyte."
In a historical Dharma ransomware negotiation uncovered by researchers, the Russian-speaking affiliate explicitly directed a desperate victim to contact an IT specialist via the email address [email protected]. Intelligence platforms like Constella Intelligence subsequently linked a personal email address historically used by Tobok ([email protected]) to online accounts bearing the "Ghostbyte" username. Furthermore, the cryptocurrency wallet tied to the Dharma representative processed over 43 bitcoin (valued at approximately $3.5 million today).
While Tobok has faced no criminal charges in connection with these historical artifacts, he and Dubrovsky have been embroiled in bitter civil litigation in Ontario, Canada, following a falling out over corporate governance at Cypfer. Dubrovsky previously alleged in court filings that he became collateral damage in a campaign by Tobok to "destroy" business rivals.
Official Responses and Industry Fallout
The corporate entities caught in the crossfire have moved swiftly to distance themselves from the scandal.
In an official statement released on October 14, Cypfer asserted that it had no prior knowledge of Edward Dubrovsky’s arrest and does not facilitate illicit ransomware payments.
"CYPFER has not received any outreach from law enforcement and, to our knowledge, is not the target of any law enforcement investigation," a company spokesperson stated via email.
Cypfer noted that it operates entirely independently of CyberSteward Inc.—a firm linked to previous ShinyHunters negotiations—and highlighted its recent acquisition by the Apros Group, a holding company led by former FBI special agent Jason Hogg.
Meanwhile, prominent incident response firms that strictly oppose extortion payments—such as Coveware and Unit 221B—found themselves targeted by the hackers. Leaked Telegram chats from May 2026 reveal the absolute frustration of ShinyHunters leadership over Coveware’s refusal to let clients pay.
"Go on my website, majority of those companies would’ve paid if it weren’t for Coveware giving them misinformation," the ShinyHunters admin complained to a co-conspirator, adding that they were actively looking to "eliminate the problem."
Implications: Conflict of Interest in Cyber Extortion
The unfolding scandal highlights a foundational conflict of interest within the cybersecurity response market. According to Mark Camillo, Chief Executive of CyberAcuView, many firms specializing in ransom negotiations charge a percentage-based fee tied directly to the final payout amount.
"This makes no sense if they are also the negotiator," Camillo warned. "There needs to be more transparency in the process as no one in the ecosystem should be profiting purely on the size of the ransomware transaction."
When negotiators stand to make more money by convincing terrified clients to acquiesce to multi-million-dollar demands, the incentive to push back against extortion evaporates. This structural alignment between rogue negotiators and threat actors threatens to compromise the integrity of the entire incident response vertical.
A Crackdown on Rogue Negotiators
The Department of Justice is signaling that the era of unregulated, back-channel ransom payouts is coming to an end. Beyond the arrest of Edward Dubrovsky and the charges against MonsterCloud CEO Zohar Pinhasi, federal authorities previously secured a 70-month prison sentence for Florida negotiator Angelo Martino, who fed confidential client negotiation strategies directly to the BlackCat/ALPHV ransomware gang to maximize payouts.
As federal investigators parse through Pepijn van der Stap’s seized Signal logs and question international suspects like "Rey," the message to the cybersecurity industry is unmistakable: the cozy relationship between intermediaries and cyber extortion syndicates is officially under criminal indictment.
By Reynand Wu 
Lina Irawan 
rifanmuazin 
Neng Nana 