Feds Eye Ransom Negotiators in ShinyHunters Probe, Suspect One Aided Extortion Site
U.S. federal investigators are reportedly scrutinizing executives from two ransomware negotiation firms who allegedly maintained unusually close relationships with the ShinyHunters hacking collective. Sources close to the investigation suggest that at least one executive in the United States may have actively assisted ShinyHunters in operating a website designed to pressure victims into paying ransoms.
This development comes in the wake of ShinyHunters' recent high-profile breach of the FBI's recruitment website, fbijobs.gov, where the group threatened to release sensitive employee data. The FBI has responded with urgency, detaining and questioning individuals with known communications with the group's alleged leader, a teenage hacker known as "Rey."
The ShinyHunters Network and Recent Arrests
ShinyHunters, a group responsible for numerous data breaches since 2019, has reportedly extorted over $70 million this year. Control of the group, initially operated by French cybercriminals, eventually passed to "Rey," identified as a Jordanian teenager. The FBI's investigation gained significant traction following the arrest of Pepijn van der Stap, a Dutch hacker and suspected ShinyHunters member, on September 15, 2026. Dutch authorities reportedly apprehended Van der Stap while he was logged into his Signal account, providing investigators with access to recent communications.
These communications allegedly revealed a murder-for-hire plot and provided crucial links to individuals involved in ransomware negotiations. In parallel, on October 9, the FBI arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the ShinyHunters investigation. Dubrovsky, who recently authored a book advocating for engagement with hackers, faces charges related to threatening the disclosure of stolen data and interfering with commerce through extortion.
Suspected Complicity and the Shinywire Website
Federal investigators believe that Van der Stap's Signal messages implicated both Dubrovsky and at least one executive at a U.S.-based consulting firm. These individuals allegedly possessed advance knowledge of ShinyHunters' victims, sometimes before the victims themselves were aware of a breach. Most alarmingly, evidence suggests Dubrovsky was aware of the FBI data breach and did not notify the bureau before ShinyHunters threatened to publish the stolen files.
Further investigation has focused on shinywire[.]com, a website operated by ShinyHunters from approximately May 3 to October 16, 2026. This site listed nearly 100 organizations breached by ShinyHunters, urging victims to negotiate payments and threatening to publish stolen data if demands were ignored. Sources indicate that an executive from a prestigious U.S. consulting firm may have played an active role in operating this extortion website.
Conflicts of Interest in Ransomware Negotiations
The investigation also touches upon the complex and often ethically ambiguous world of ransomware negotiation. While paying ransoms is not illegal in the U.S. unless the group is sanctioned, experts highlight inherent conflicts of interest. Firms that negotiate ransom payments often charge a percentage of the total amount paid, creating a financial incentive to facilitate larger payouts rather than seeking to minimize them. This dynamic is further complicated by the fact that there is no technical guarantee that stolen data will be deleted or not re-sold after a ransom is paid, as demonstrated by subsequent extortion attempts against PowerSchool users after an initial ransom payment.
Industry experts and law enforcement agencies, including the FBI, have consistently advised against paying ShinyHunters, noting the group's history of retaining and reusing stolen data. The FBI's alert on May 15, 2026, specifically warned victims against engaging with the group. In response, ShinyHunters members have reportedly harassed and threatened firms like Coveware and Unit 221B for advising against payments, viewing them as obstacles to their extortion schemes.
Recent actions by the U.S. Department of Justice against ransomware negotiators, such as the charges against MonsterCloud CEO Zohar Pinhasi and the sentencing of Angelo Martino, underscore the increasing scrutiny on individuals who allegedly conspire with cybercriminals.
