Inside the Extortion Syndicate: FBI Probes Ransomware Negotiators and Their Deep Ties to the ShinyHunters Hacking Collective

WASHINGTON — In a stunning escalation of an international cybercrime investigation, U.S. federal investigators pursuing the notorious ShinyHunters hacking group have set their sights on the upper echelons of the cybersecurity industry itself. Authorities examining the syndicate—which recently breached the FBI’s own recruitment portal—have identified executives at two separate ransomware negotiation firms who allegedly maintained unusually close, illicit relationships with the extortionists.

According to sources close to the sprawling federal probe, at least one U.S.-based executive went far beyond advisory boundaries, actively assisting ShinyHunters in operating a victim-shaming and pressure website designed to compel compromised organizations into paying multi-million-dollar ransoms.

The developments expose a dark underbelly in the multi-billion-dollar incident response and cyber-extortion ecosystem, where the lines separating defenders, negotiators, and digital outlaws have become dangerously blurred.

Main Facts: The FBI Breach, the Arrests, and the Intermediaries

The federal investigation gained breakneck momentum following a series of high-profile arrests in Europe and North America. At the center of the probe is ShinyHunters, a prolific cybercriminal collective responsible for dozens of massive data breaches since 2019.

The group’s current operations are believed to be orchestrated by a teenager known online as “Rey,” identified last year as a resident of Amman, Jordan. According to FBI estimates, ShinyHunters has extorted more than $70 million from corporate and government victims globally this year alone.

The group crossed a critical threshold in late September, when hackers tied to ShinyHunters successfully breached fbijobs.gov, the bureau’s official recruitment website. The threat actors brazenly taunted law enforcement by threatening to publish deeply sensitive personnel files. The stolen data reportedly included:

• Social Security numbers
• Home addresses
• Medical and psychological records
• Specific unit assignments and specializations of FBI employees

The audacious hack of a federal law enforcement portal forced the bureau to move with uncommon speed. On October 3, Reuters reported that "Rey" had been detained by Jordanian authorities and was actively cooperating with the FBI.

The Fall of Pepijn van der Stap and the Canadian Connection

Rey’s rise to power within the syndicate followed the sudden neutralization of a senior European operator. On September 15, 2026, Dutch police—deploying flash-bang grenades to stun their target—arrested convicted hacker and ShinyHunters suspect Pepijn van der Stap.

Police apprehended Van der Stap while he was actively logged into his Signal instant messaging account. This tactical advantage allowed investigators to immediately review his communications with frequent contacts, opening a Pandora’s box that connected the Dutch hacker directly to ransomware negotiators in Canada and the United States.

Sources indicate that analysis of Van der Stap’s decrypted chats revealed an alarming plot: investigators believe Van der Stap issued orders for a murder-for-hire plot targeting individuals abroad, though there is no indication those orders were ever carried out.

More immediately relevant to the cyber investigation, the Signal logs revealed that Van der Stap was in constant communication with Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive. Dubrovsky, who recently published a book on handling cyber extortion that advised companies to always engage with hackers, was arrested by the FBI on October 9. Court records show he has been charged with threatening to disclose stolen data and interfering with interstate commerce through extortion. Prosecutors have requested that he remain in custody pending trial.

Investigators claim Dubrovsky’s chat logs showed he possessed advance knowledge of the ShinyHunters breach of FBI servers—yet chose to withhold this critical intelligence from the bureau until the hackers publicly threatened to release personnel files on social media.

Chronology of an Escalating Crisis: From Dharma to Shinywire

To understand how high-level cybersecurity executives became entangled with elite threat actors, federal investigators are looking at a timeline that stretches back nearly a decade.

2018: The Genesis of "Ghostbyte"

Interviews with former colleagues suggest that long before the rise of ShinyHunters, actors within the ransomware ecosystem were already leaning on corporate intermediaries. As far back as 2018, when a Canadian company was struck by the Dharma ransomware affiliate program, the cybercriminals pointed their victim toward a trusted Canadian IT facilitator.

A redacted email from the Dharma representative directed the desperate victim to contact [email protected], writing: "If you want guarantees, you can write to the IT company… This IT company often solves such problems in Canada."

Threat-intelligence platform Constella Intelligence later linked an email address frequently used by executive Daniel Tobok ([email protected]) to online accounts utilizing the username "ghostbyte," including a Snapchat profile. Tobok, the former CEO of the prominent cyber firm Cypfer, has not responded to multiple requests for comment regarding these historical links.

May – October 2026: The Rise and Fall of "Shinywire"

Fast-forward to 2026, and the operational sophistication of ShinyHunters reached new heights with the launch of shinywire[.]com. Active from May 3 until October 16, 2026, the website served as a centralized portal for nearly 100 organizations compromised by the hacking group.

Each entry on Shinywire featured samples of stolen data and a strict ultimatum: engage with the cybercriminals to negotiate payment terms within seven days, or face total data leaks on the group’s Tor-based shaming blog. High-profile victims included medical technology giant Intuitive Surgical, which was breached in March 2026 via a targeted employee phishing attack.

According to two sources close to the probe, FBI investigators believe at least one executive at a prominent U.S.-based consulting firm played an active, hands-on role in operating the Shinywire extortion platform. While federal authorities have not yet formally named the individual or the 1,000-employee firm, the revelation marks a stunning convergence between corporate incident response and direct criminal enterprise.

Supporting Data: Economic Incentives and Conflicting Interests

The entanglement of negotiation firms with extortionists highlights a fundamental economic flaw within the multi-million-dollar ransomware remediation market.

The Retainer vs. Percentage Dilemma

According to Mark Camillo, Chief Executive of CyberAcuView (an industry group founded by major cyber insurers), compensation models in the ransomware negotiation space create an inherent, dangerous conflict of interest.

While some firms operate on a flat retainer fee, others specialize in negotiating ransom payouts and charge a percentage of the total transaction.

• The Perverse Incentive: A negotiator whose fee scales with the size of the ransom has a financial incentive to encourage payouts rather than resistance, and little motivation to negotiate the price downward.
• The Crypto Float: Negotiators frequently defend their percentage-based fees by citing the high operational risks of sourcing large amounts of cryptocurrency and managing volatile exchange fees.

Industry leaders argue that this opaque pricing structure encourages backroom deals. Recent federal prosecutions underscore this reality:

• The MonsterCloud Case: On October 7, the U.S. Department of Justice charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy. Prosecutors allege Pinhasi charged customers $19 million to remediate ransomware attacks without paying hackers, while secretly paying threat actors $8 million behind his clients’ backs.
• The Angelo Martino Sentencing: In July, ransomware negotiator Angelo Martino was sentenced to 70 months in prison for conspiring with the Blackcat/ALPHV ransomware group. Court records proved Martino fed confidential client negotiating strategies directly to the hackers to maximize extortion payouts.

The PowerSchool Precedent

The perils of negotiation are further illustrated by the December 2024 ShinyHunters breach of education technology titan PowerSchool, which compromised data belonging to 62 million students and 9.5 million teachers. PowerSchool reportedly paid a $2.85 million ransom facilitated by cybersecurity firm CyberSteward.

Yet, the payout failed to secure the data. By May 2025, individual school districts began receiving secondary extortion demands utilizing the exact same stolen records.

Leading incident response firms like Coveware and Unit 221B have consistently warned victims against paying ShinyHunters, emphasizing that cybercriminals rarely delete exfiltrated data. These warnings have made firms like Coveware primary targets for the hacking group. Internal Telegram chats reviewed by investigators show ShinyHunters leaders bitterly complaining that Coveware was ruining their business model by advising victims not to pay, with group operators explicitly discussing plans to "eliminate the problem."

Official Responses and Corporate Restructuring

As the net tightens around compromised negotiators, the corporate structures surrounding these firms are undergoing frantic reorganizations and damage control.

Following the arrest of Edward Dubrovsky, Cypfer issued a definitive public statement distancing itself from the fallout:

"We had no prior knowledge of Mr. Dubrovsky’s arrest. CYPFER has not received any outreach from law enforcement and, to our knowledge, is not the target of any law enforcement investigation."

Cypfer emphasized that CyberSteward and Cypfer are entirely separate entities sharing no common officers, directors, or employees. Furthermore, Cypfer noted it was recently acquired by the Apros Group, a holding company led by Jason Hogg—a former FBI special agent and former CEO of Aon Cyber Solutions Group. (Aon previously acquired Cytelligence, a security firm where Daniel Tobok served as founder and CEO and Edward Dubrovsky as managing partner).

Meanwhile, federal agencies continue to ramp up warnings. In a May 2026 public service announcement, the FBI and the Internet Crime Complaint Center (IC3) explicitly advised organizations against paying ransoms to ShinyHunters, citing the near-certainty that stolen data will be retained, resold, or weaponized regardless of payment.

Broader Implications: Restoring Trust in Incident Response

The federal investigation into ShinyHunters and its alleged corporate enablers represents a watershed moment for the cybersecurity industry. For years, the dirty secret of corporate data breaches has been the quiet transfer of untraceable cryptocurrency to digital extortionists, brokered by intermediaries operating in legal and ethical grey zones.

The exposure of executives allegedly collaborating on extortion portals like Shinywire and maintaining unholy alliances with threat actors demonstrates that some self-proclaimed defenders have crossed the line to become active participants in cybercrime.

Experts argue that sweeping reforms are urgently needed to restore integrity to the incident response ecosystem:

1. Mandatory Transparency: Regulatory bodies and cyber insurance carriers must demand full transparency regarding how incident response and negotiation fees are calculated, eliminating percentage-based incentives tied to ransom volumes.
2. Strict Separation of Duties: Clear legal firewalls must be erected between digital forensics firms that investigate breaches and commercial entities that facilitate ransom payments.
3. Enhanced Vetting: Cybersecurity firms and insurance providers must subject their own leadership and high-level negotiators to rigorous background checks to prevent insider infiltration by criminal syndicates.

As the Department of Justice presses forward with prosecutions against figures like Edward Dubrovsky and Zohar Pinhasi, the message to the cybersecurity sector is unmistakable: the era of unchecked, backroom extortion negotiations is drawing to a close, and those who treat cybercrime as a collaborative business model will face the full weight of federal law.