FBI Uncovers Suspected Links Between Ransomware Negotiators and ShinyHunters Hackers

Federal investigators examining the ShinyHunters group have uncovered potential connections between the extortion group and executives at two ransomware negotiation firms, according to a KrebsOnSecurity investigation published on October 19.

Sources familiar with the inquiry revealed that an executive from an unnamed U.S. consulting company allegedly assisted in operating the group’s victim extortion website. This has raised concerns about whether trusted intermediaries may have engaged in criminal collaboration.

The allegations are still under investigation, and KrebsOnSecurity has withheld the American company’s identity because authorities have not charged the suspected executive(s). The firm reportedly employs over 1,000 associates.

The investigation reportedly gained momentum after authorities arrested suspected ShinyHunters member Pepijn van der Stap in the Netherlands on September 15. Authorities detained him while his Signal account remained accessible, allowing investigators to review recent conversations with contacts, including ransomware negotiators in Canada and the United States.

According to sources cited by KrebsOnSecurity, these messages indicated frequent communication with Canadian cybersecurity executive Edward Dubrovsky and at least one executive at the American consulting firm. The negotiators reportedly knew details about some ShinyHunters victims before those organizations even knew they had been breached.

Dubrovsky, 54, was subsequently arrested as part of the investigation and charged with threatening to disclose stolen or hacked information and interfering with interstate commerce through extortion. Prosecutors have sought to keep him detained while related records remain sealed. These charges are allegations, not findings of guilt.

One source claimed that Dubrovsky was aware of stolen FBI information before ShinyHunters publicly threatened to release it, but did not notify the bureau in advance.

Investigators also believe an executive from the American consulting firm helped operate shinywire.com, a now-defunct extortion portal active from about May 3 to October 16, 2026. During its operation, the website listed nearly 100 organizations ShinyHunters targeted.

The site combined samples of stolen information with demands for victims to negotiate payments. Organizations that did not respond within seven days risked having their stolen datasets published on the group’s separate Tor-accessible leak blog. This established a workflow that used public exposure deadlines to increase pressure on victims.

One cached listing targeted Intuitive Surgical, which had reported a March 2026 incident involving a phishing email that compromised an employee’s credentials. This example shows how credential theft can fuel data extortion without needing file encryption.

The investigation intensified after the late-September breach of fbijobs.gov, which reportedly stole medical and psychological information, Social Security numbers, addresses, and personnel assignment details. Reuters later reported that Jordanian authorities detained ShinyHunters operator “Rey,” who was cooperating with the FBI.

The reporting also highlights conflicts of interest surrounding negotiators whose compensation is tied to the final ransom amount. Mark Camillo, chief executive of CyberAcuView, warned that percentage-based fees can incentivize larger payments rather than reductions, calling for greater transparency in transactions.

PowerSchool illustrates the potential limitations of payment assurances. Following its December 2024 breach, the company reportedly paid $2.85 million with assistance from CyberSteward. School districts later received additional demands involving the same stolen records, though the report does not attribute this second wave to ShinyHunters.

Cypfer, Dubrovsky’s former firm, stated that it does not facilitate ransom payments, had no prior knowledge of his arrest, and was unaware of any investigation targeting it. The company clarified that it and CyberSteward have no shared officers, directors, or employees.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.