Federal investigators in the United States have widened their cross-border dragnet targeting the prolific cybercriminal syndicate known as ShinyHunters, unearthing a web of corruption that extends deep into the legitimate cybersecurity and ransomware negotiation industry. According to internal sources close to the ongoing federal inquiry, investigators have identified executives at two distinct ransomware negotiation firms who allegedly maintained unusually close, illicit relationships with the extortion collective. Most alarmingly, sources reveal that at least one U.S.-based executive allegedly assisted ShinyHunters in operating an active public pressure portal used to coerce victims into compliance.
The investigation has accelerated dramatically following a series of high-profile cyberattacks, most notably the late-September breach of the FBI recruitment website, fbijobs.gov. This brazen intrusion—which compromised sensitive personnel files, Social Security numbers, and psychological records—spurred federal law enforcement into an aggressive posture, yielding swift arrests across Europe, the Middle East, and North America. As the Department of Justice (DOJ) scrutinizes the structural flaws and financial conflicts of interest plaguing the cyber incident response sector, the unfolding scandal reveals how certain bad actors within the defense community transitioned from protecting enterprise networks to actively collaborating with the extortionists they were hired to thwart.
Detailed Chronology: From the Netherlands to Canada
The unraveling of the ShinyHunters conspiracy stems from a coordinated series of international law enforcement actions that dismantled the group’s leadership structure and exposed deep-seated corruption within third-party negotiation firms.
The Downfall of Pepijn van der Stap
On the evening of September 15, 2026, Dutch law enforcement executed a high-stakes raid in the Netherlands, deploying flash-bang grenades to stun and apprehend Pepijn van der Stap, a convicted hacker and core suspect in the ShinyHunters operation. Police successfully seized Van der Stap while he was actively logged into his Signal instant messaging account. This tactical precision allowed authorities to harvest real-time communications and unencrypted chat logs with frequent contacts, including ransomware negotiators stationed in Canada and the United States.
According to investigative sources, Van der Stap’s seized Signal logs served as the Rosetta Stone for uncovering a broader criminal conspiracy. The chats not only mapped out the digital footprint of the global extortion ring but also allegedly pointed toward an attempted murder-for-hire plot. Dutch news outlet RTL reported that orders for two foreign assassinations were allegedly tied back to Van der Stap—though authorities emphasize there is no indication those violent plots were ultimately carried out.
With Van der Stap neutralized, control over the ShinyHunters apparatus briefly shifted to "Rey," a teenage hacker from Amman, Jordan, identified in previous cybersecurity intelligence reports as a central administrator for the Scattered Lapsus Hunters cluster. However, international pressure quickly caught up to the new leadership; on October 3, Reuters reported that Jordanian authorities had detained Rey, who immediately began cooperating with the FBI.
The Arrest of Edward Dubrovsky
The decrypted communications seized from Van der Stap’s device provided the direct link to Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive and author of a recent textbook advising companies on how to handle cyber extortion. On October 9, the FBI arrested Dubrovsky, with federal prosecutors in the United States charging him with threatening to disclose hacked data and interfering with interstate commerce through extortion.
Court records and subsequent reports from Politico indicate that federal prosecutors requested Dubrovsky be held without bail pending trial, keeping case documents heavily sealed. Investigators discovered that Dubrovsky maintained an ongoing dialogue with Van der Stap, often possessing insider knowledge regarding new ShinyHunters victims before the targeted organizations even realized they had been breached. Most damningly, federal findings suggest Dubrovsky was aware that ShinyHunters had successfully compromised high-level FBI servers yet deliberately withheld this information from the bureau, remaining silent until the hackers publicly taunted the agency on social media.
The Rise and Fall of "Shinywire"
Building upon the digital evidence recovered from Van der Stap, investigators uncovered the inner workings of shinywire[.]com, a dedicated victim-shaming and extortion portal operated between May 3 and October 16, 2026. Featuring nearly 100 corporate and institutional victims—including American medical technology giant Intuitive Surgical, which suffered a credential-harvesting phishing attack in March 2026—the site functioned as an aggressive psychological pressure cooker.
Entries on Shinywire featured samples of stolen proprietary data alongside a strict seven-day ultimatum: organizations that failed to negotiate terms of payment would see their entire cache of stolen files permanently leaked on the group’s Tor-hidden dark web blog. Sources close to the probe state that federal investigators believe at least one executive at a prestigious U.S.-based consulting firm with over 1,000 employees played an active, hands-on role in operating and maintaining the Shinywire domain.
The "Ghostbyte" Connection and Corporate Feuds
The corporate turf wars underlying the ransomware remediation industry have further complicated the legal landscape. Prior to his arrest, Edward Dubrovsky filed a lawsuit in Ontario against Daniel Tobok, the former chief executive of Cypfer, a Toronto-founded cybersecurity firm with global reach. Dubrovsky claimed he was made collateral damage in a malicious campaign by his former business partner designed to "destroy" him after a falling out in 2024. Tobok denied the allegations, filing a countersign counter-claim accusing Dubrovsky of misappropriating confidential information and competing unfairly via another entity, CyberSteward Inc.
Adding a bizarre historical layer to the saga, former colleagues of Daniel Tobok revealed that as far back as 2018, he was known within Russian-language ransomware circles by the alias "Ghostbyte." During an investigation into a 2018 attack orchestrated by the prolific Dharma ransomware affiliate program, a victim seeking payment guarantees was explicitly directed by a Dharma representative to contact an IT professional via the email address [email protected]. While Tobok has not responded to requests for comment regarding the old alias, threat intelligence firm Constella Intelligence discovered that a personal email address frequently used by Tobok ([email protected]) is tied to online profiles bearing the "ghostbyte" username, including a Snapchat account. Furthermore, Constella linked the Dharma representative’s wallet address to blockchain transactions exceeding 43 Bitcoin (valued at approximately $3.5 million).
Supporting Context & Metrics: The Economics of Extortion
To fully grasp how trusted cybersecurity executives became entangled with extortion rings, one must examine the macro-level economics of the modern ransomware ecosystem.
The Scale of ShinyHunters
Active since 2019—initially operated by cybercriminals based in France before leadership transitioned to international actors—ShinyHunters has claimed credit for dozens of high-profile corporate data breaches. According to official FBI estimates, the syndicate has successfully extorted more than $70 million from corporate and government victims globally over the course of 2026 alone.
Notable operations include the December 2024 breach of educational technology provider PowerSchool, which resulted in the theft of private records belonging to 62 million students and 9.5 million teachers across the United States and Canada. PowerSchool reportedly paid a $2.85 million ransom following guidance from incident response providers. Despite the payment, individual school districts were subsequently hit with independent extortion demands using identical data samples, highlighting the hollow nature of cybercriminal promises regarding data deletion. (Matthew Lane, a 20-year-old ShinyHunters affiliate from Sterling, Massachusetts, was sentenced in November 2025 to four years in prison for his role in the PowerSchool intrusion).
Conflicts of Interest in Ransomware Remediation
The mechanics of incident response create a structural vulnerability ripe for exploitation. While paying a ransom is not inherently illegal in the United States unless the threat actor is officially sanctioned by the Department of the Treasury’s Office of Foreign Assets Control (OFAC)—and ShinyHunters currently lacks such designation—the fee structures utilized by certain remediation firms introduce severe conflicts of interest.
Mark Camillo, Chief Executive of CyberAcuView (an industry group formed in 2021 by major cyber insurance carriers), notes that while some firms charge flat retainers, others operate on a contingency model, charging a percentage of the total ransom payout.
"This makes no sense if they are also the negotiator," Camillo observed. "There needs to be more transparency in the process as no one in the ecosystem should be profiting purely on the size of the ransomware transaction or payment itself."
This misaligned incentive structure has driven unscrupulous negotiators to collaborate directly with threat actors. Leaked Telegram communications from ShinyHunters leadership in April and May 2026 revealed intense frustration directed at reputable incident response firms like Coveware and Unit 221B, whose analysts consistently advise victims not to pay ransoms. In private chats, the ShinyHunters administrator complained that Coveware’s staunch anti-extortion stance was systematically destroying their profit margins, explicitly stating they were attempting to "eliminate the problem" posed by Coveware’s interference.
Department of Justice Crackdowns
Federal authorities are aggressively targeting this corrupt subset of negotiators. Beyond the arrest of Edward Dubrovsky, the DOJ has taken severe legal action against other bad actors in the remediation space:
October 7, 2026: The DOJ charged MonsterCloud CEO Zohar Pinhasi (50) with wire fraud and conspiracy. Prosecutors allege Pinhasi charged clients millions for remediation while secretly paying hackers behind their backs—draining $8 million to pay cybercriminals while billing corporate clients $19 million.
July 2026:Angelo Martino, a 41-year-old ransomware negotiator from Florida, was sentenced to 70 months in prison after conspiring with the BlackCat/ALPHV ransomware gang. Martino systematically leaked confidential client negotiation strategies to the hackers to help them maximize extorted payouts.
Official Statements & Industry Fallout
The corporate entities caught in the crossfire have moved quickly to distance themselves from the unfolding criminal investigations.
In a formal statement released on October 14, Cypfer maintained that its corporate scope of services does not include facilitating ransomware payments. Furthermore, the company asserted it had no prior knowledge of Edward Dubrovsky’s illegal activities or his subsequent arrest until media reports surfaced.
"CYPFER has not received any outreach from law enforcement and, to our knowledge, is not the target of any law enforcement investigation," a company spokesperson stated via email.
Cypfer further clarified its corporate lineage, noting that it operates entirely separate from CyberSteward with zero overlapping officers, directors, or employees. Cypfer was recently acquired by the Apros Group, a holding company led by Jason Hogg—a former FBI special agent and former CEO of Aon Cyber Solutions Group. Aon previously acquired Cytelligence in 2020, a security firm where Daniel Tobok served as founder and CEO, and Edward Dubrovsky served as managing partner.
Meanwhile, industry heavyweights and cyber insurers are facing mounting pressure to reform how incident response and negotiation services are contracted, audited, and overseen.
Future Outlook: Rebuilding Trust in Cyber Defense
The unmasking of executives at ransomware negotiation firms operating hand-in-hand with groups like ShinyHunters marks a watershed moment for the cybersecurity industry. For years, the enterprise sector relied on third-party negotiators as trusted intermediaries capable of safely steering organizations through catastrophic digital hostage crises. The revelations that certain trusted professionals leaked confidential victim strategies, engineered extortion portals, and shielded high-level breaches from law enforcement have shattered that illusion of trust.
As the Department of Justice and federal investigators press forward with criminal trials against figures like Edward Dubrovsky and Zohar Pinhasi, the broader industry faces a painful reckoning. Moving forward, institutional clients, cyber insurance underwriters, and regulatory bodies are expected to demand unprecedented transparency into incident response operations. Strict regulatory frameworks must be established to eradicate contingency-fee ransom models, eliminate conflicts of interest, and ensure that those hired to defend the digital ecosystem are never again allowed to switch sides and profit from the chaos.
