Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

U.S. federal investigators chasing the ShinyHunters hacking group have identified executives at two ransomware negotiation firms who maintained unusually close ties to the extortion gang, according to an October 19, 2026 report from KrebsOnSecurity. One of them, Canadian cybersecurity executive Edward Dubrovsky, was arrested by the FBI on October 8, 2026, while attending the Cyber Risk Summit in Philadelphia. Sources say an executive at a second firm — a large U.S. consulting firm with more than 1,000 associates — actively helped ShinyHunters build and run the extortion website the group used to pressure victims into paying. The probe grew out of the FBI's own embarrassment: in late September, ShinyHunters breached the bureau's recruitment site, fbijobs.gov, and stole highly sensitive personnel data on thousands of agents.

Details

What Happened

A Break-In at the FBI's Own Front Door

ShinyHunters' breach of fbijobs.gov reportedly began with CVE-2026-35273, a vulnerability in the Environment Management Hub component of the FBI's Oracle PeopleSoft deployment. Krebs reports that an Accenture contractor responsible for patching the system had been removed from the engagement, leaving the flaw unaddressed. From that initial foothold, the attackers pivoted into the bureau's Amazon Web Services GovCloud environment and made off with more than 2 terabytes of data, including Social Security numbers, home addresses, medical and psychiatric records, and details on individual agents' unit assignments and specializations. ShinyHunters publicly taunted the FBI on X (formerly Twitter), threatening to publish the files if its demands were ignored.

Negotiators With Inside Knowledge

The thread connecting negotiators to the group runs through a separate arrest. When Dutch police detained convicted cybercriminal Pepijn van der Stap on September 15, 2026, they seized his devices and recovered Signal messages showing frequent, direct communication between Van der Stap and both Dubrovsky and the unnamed U.S. consulting-firm executive. Those messages reportedly show Dubrovsky knew ShinyHunters had already stolen the FBI data well before the group's public threats — and that he never alerted the bureau. Sources told Krebs that at least one of the two executives went further still, actively helping operate the Shinywire extortion site itself.

Shinywire: Extortion as a Website

Shinywire.com functioned as a pressure campaign dressed up as a leak site. Live from May 3 to October 16, 2026, it listed roughly 100 organizations ShinyHunters claimed to have hacked, each entry featuring sample stolen files and a running clock urging victims to pay before publication. Internal ShinyHunters Telegram messages reviewed by Krebs show the group grew frustrated that incident-response firms were discouraging payment: on May 6 the group complained that "someone (100% Coveware) is going out of their way to make sure i am not paid," and separately argued that "the majority of those companies would've paid if it weren't for Coveware giving them misinformation." The FBI issued a public alert on May 15, 2026 warning victims not to pay ShinyHunters at all. The Shinywire site went dark on October 16, three days before Krebs' report, shortly after Dubrovsky's arrest became public.

A Rivalry That Predates the Investigation

Dubrovsky and Tobok became business partners in 2017, co-founding the ransomware-response firm Cypfer. The partnership soured by 2024, when Dubrovsky filed an Ontario lawsuit against Tobok; the Globe and Mail detailed that falling-out on October 15, 2026. Separately, researchers at Constella Intelligence linked one of Tobok's personal email addresses, dtobok@me.com, to two online accounts using the handle "ghostbyte" — the same alias that appeared in 2018 as a contact address (ghostbyte@tutanota.com) that the Dharma ransomware group gave victims for negotiating payment. Tobok has not been charged and has not responded to requests for comment; Cypfer issued a statement saying it "had no prior knowledge of Mr. Dubrovsky's arrest."

Mounting Arrests Around the Group

Dubrovsky's arrest is the latest in a string tied to the ShinyHunters investigation. On October 3, 2026, Jordanian authorities detained a suspected ShinyHunters leader identified as "Rey" — previously named by Krebs as Saif Al-din Khader — who is now reportedly cooperating with the FBI. The Van der Stap arrest in the Netherlands on September 15 was carried out with flash-bang grenades and is tied to a separate, alleged murder-for-hire plot. The broader ransomware-negotiation industry has already seen fallout this year: Zohar Pinhasi, CEO of MonsterCloud, was charged with wire fraud on October 7, 2026, and negotiator Angelo Martino was sentenced in July 2026 to 70 months in prison. Matthew Lane, the 20-year-old behind the 2024 PowerSchool hack that first drew ShinyHunters-linked extortion into headlines, was sentenced to four years in November 2025.

Impact Assessment

Recommendations

For organizations working with ransomware negotiation firms

1. Demand fee-structure transparency up front. Understand whether a firm charges a flat fee or a percentage of the ransom before engaging it — percentage-based fees create a direct financial incentive to see payment happen.
2. Require disclosure of any prior contact with the threat actor group. A negotiator with an existing back-channel to the extortion group is not a neutral party.
3. Loop in outside counsel and law enforcement at first contact, not after a payment decision has already been shaped by the negotiator.
4. Cross-check any "you should pay" recommendation against independent threat-intel advisories, including active FBI alerts naming the group involved.

For federal agencies and large employers

1. Treat theft of Social Security numbers plus medical/psychiatric records as a top-priority notification event — offer credit monitoring and identity-protection services to affected personnel immediately.
2. Assign explicit contractual ownership of patch management for third-party-supported systems like Oracle PeopleSoft; a removed contractor should never leave a known vulnerability unpatched.
3. Segment and separately monitor cloud environments (such as AWS GovCloud) from on-premises HR and ERP systems, since lateral pivoting between the two is a well-known attack path.

For security teams generally

1. Audit incident-response retainer vendors with the same due diligence applied to software supply-chain vendors — this is a trust relationship, not just a service contract.
2. Monitor for FBI and CISA alerts naming ShinyHunters and treat any active negotiation involving the group as higher-risk pending further guidance.

Key Takeaways

1. The FBI arrested Canadian cybersecurity executive Edward Dubrovsky on October 8, 2026, on extortion and conspiracy charges tied to the ShinyHunters investigation.
2. A second, unnamed executive at a large U.S. consulting firm is suspected of actively helping operate Shinywire.com, the group's extortion website, which went offline October 16.
3. Key evidence comes from Signal messages recovered after the September 15, 2026 Dutch arrest of ShinyHunters associate Pepijn van der Stap.
4. ShinyHunters breached the FBI's fbijobs.gov by exploiting Oracle PeopleSoft flaw CVE-2026-35273, then pivoted into AWS GovCloud to steal more than 2 terabytes of personnel data.
5. The group has extorted more than $70 million from upwards of 140 organizations since 2025, according to the FBI.
6. The case exposes a structural conflict of interest in percentage-fee ransomware negotiation, with industry figures calling for greater transparency.

Sources

• KrebsOnSecurity — Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
• KrebsOnSecurity — FBI Arrests Executive at Ransomware Negotiation Firm
• Bank Info Security — Canadian Ransomware Negotiator Arrested in FBI Breach Probe