Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

Takeaway

Federal investigators have identified executives at two ransomware negotiation firms as key participants in operating the ShinyHunters extortion website shinywire.com, exposing a direct conflict of interest that helped the group extort over $70 million this year.

ShinyHunters’ Recent Escalation

ShinyHunters, a hacking group active since 2019, stole sensitive FBI personnel data from fbijobs.gov in September 2026, prompting rapid FBI arrests.
The group’s leader, a teenage hacker known as Rey from Amman, Jordan, took control after earlier members were jailed.
Dutch police arrested suspected member Pepijn van der Stap on September 15, 2026, using flash‑bang grenades while he was logged into Signal. His messages revealed frequent contact with ransomware negotiators in the U.S. and Canada.
The FBI also arrested Canadian cyber‑security executive Edward Dubrovsky (54) on October 9, charging him with threatening to disclose stolen data and interfering with interstate commerce.

"Van der Stap’s Signal messages showed he had frequent conversations with Mr. Dubrovsky and with at least one executive at a large U.S.-based consulting firm, and that these executives often knew the details about new ShinyHunters victims before the victims themselves had even learned of the breach." – source close to the investigation

The Shinywire Extortion Site

shinywire.com operated from May 3 to October 16, 2026, listing nearly 100 compromised organizations and demanding ransom payments.
Each entry displayed stolen file samples and warned that refusal would lead to publication on a Tor‑only victim‑shaming blog.
The site was hosted by an executive at a prestigious U.S. consulting firm with over 1,000 staff, though the firm has not been charged.
Example: a cached page targeted Intuitive Surgical, showing a typical demand and sample data.

Shinywire homepage

Intuitive Surgical extortion page

Conflict of Interest in Ransom Negotiation

Negotiation firms often receive a percentage fee of the ransom paid, creating a financial incentive to push victims toward payment.
Mark Camillo, CEO of CyberAcuView, warned that negotiators who also profit from the payout have a misaligned incentive to inflate ransom amounts.
The DOJ has recently prosecuted negotiators for fraud and collusion, including:
- Zohar Pinhasi, CEO of MonsterCloud, charged with wire fraud for overcharging clients while secretly paying ransomware groups.
- Angelo Martino, sentenced for conspiring with the BlackCat/ALPHV group to provide attackers with victim strategy.

Evidence of Direct Collaboration

Signal logs from Van der Stap showed Dubrovsky was aware of the FBI breach but failed to alert the agency before ShinyHunters threatened to publish the data on X/Twitter.
Dubrovsky’s own court filings claim he was a victim of a business dispute with former partner Daniel Tobok of Cypfer, a firm later acquired by the Apros Group.
A separate thread of the investigation links Tobok to the nickname "Ghostbyte", which appeared in a 2018 Dharma ransomware email recommending victims contact ghostbyte@tutanota.com.

"If you want guarantees, you can write to the IT company…" – Dharma ransomware reply referencing ghostbyte@tutanota.com

Industry Reaction and Ongoing Risks

Victims such as PowerSchool paid $2.85 million after a ShinyHunters breach, yet the stolen data continued to be used for secondary extortion attempts.
Cyber‑incident response firms Coveware and Unit 221B have publicly warned against paying ShinyHunters, citing evidence that the group retains and resells data.
The FBI’s May 15, 2026 alert advised organizations not to pay ShinyHunters, but the group retaliated by harassing Coveware staff on Telegram.

Key Takeaways for Security Leaders

Negotiator involvement can create a direct pipeline for extortion groups – the Shinywire case shows negotiators may help host and publicize ransom demands.
Fee structures that depend on ransom size are a conflict of interest – regulators and insurers should require transparent, flat‑fee models.
Law enforcement can leverage real‑time messaging metadata – the Dutch flash‑bang arrest and Signal intercepts were pivotal in exposing the collusion.
Victim‑shaming blogs on Tor amplify pressure – even after payment, stolen data may be republished, underscoring the need for data‑remediation beyond ransom.

All information is drawn from the Krebs on Security investigation and publicly available court, news, and intelligence sources. No details have been fabricated.