US federal investigators, still chasing the ShinyHunters hacking group, say executives at 2 different ransomware negotiation firms were in cahoots with the gang. One of them even helped the crooks, who recently breached the FBI, to operate their extortion site.

According to KrebsOnSecurity, FBI investigators believe at least one executive at a US-based consulting firm played an active role in running the now-defunct ShinyHunters victim extortion site, the Shinywire.

The site was active from May until October 2026 and had entries for nearly 100 organizations hacked by ShinyHunters. Each entry pressured victims to reach out, negotiate payment terms, and ultimately pay the ransom.

The outlet’s sources claim the unnamed executive worked (or still works) at a prestigious firm with more than 1,000 associates.

The individual hasn’t yet been charged with any crime, but the suspicion is that they conspired with ShinyHunters to defraud the companies they were supposed to get out of trouble.

Arrests in the Netherlands and Jordan

It’d be logical to assume that the feds discovered the executives’ ties to ShinyHunters after the hackers breached the FBI recruitment website fbijobs.gov in late September and investigators began earnestly pursuing gang members.

According to KrebsOnSecurity, though, the story kicked off a little earlier because the FBI hack only occurred when “Rey,” a teenage hacker from Jordan, took control of the ShinyHunters brand.

And “Rey,” whose real name is Saif al-Din Khader, was only able to do so because, just days earlier, authorities in the Netherlands had detained another ShinyHunters member, Pepijn van der Stap.

Using flash-bang grenades, the cops managed to gain access to Van der Stap’s accounts and read his Signal chats, where they found the hacker’s communications with ransomware negotiators based in Canada and the US.

Curiously, the September 15th arrest was only announced 2 weeks later. That probably gave the FBI and investigators elsewhere time to figure out their next moves.

First, ShinyHunters announced it had breached the FBI. Then, a week later, on September 29th, “Rey” was brought into custody in Jordan. As per Reuters, he immediately began cooperating with the FBI to help track down others in the group.

Only then, on October 9th, the FBI – and its director Kash Patel on X – announced it had arrested a 54-year-old Canadian cybersecurity executive named Edward Dubrovsky.

According to court records, Dubrovsky was charged with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion.

Did Dubrovsky know about the FBI hack?

Curiously, Dubrovsky recently published a book on handling cyber extortion that recommended always engaging with the hackers.

This is how the book is marketed: “Communicating with a criminal is not the same as negotiating a payment, and negotiating is not a commitment to pay.”

A source told KrebsOnSecurity that Van der Stap’s Signal messages proved he had frequent conversations with Dubrovsky, but also at least one other executive at a large American consulting firm.

These executives often knew the details about new ShinyHunters victims before the victims themselves had even learned of the breach,

KrebsOnSecurity said.

Moreover, the feds appear to be claiming that Dubrovsky knew about the FBI hack but never informed the agency of the data breach before ShinyHunters finally threatened to publish the stolen files.

Officially, that second executive isn’t named. But the online breadcrumbs are leading to Daniel Tobok, the former chief executive of Cypfer, a Toronto-based cybersecurity firm.

As The Globe and Mail reported on October 15th, Tobok and Dubrovsky were business partners at Cybfer, but had a falling out in 2024, with the argument ending in Dubrovsky filing a lawsuit against Tobok for gradually excluding him from business matters.

More importantly, Tobok was for years known to ransomware purveyors as Ghostbyte, and Ghostbyte seems to have been a part of ransom negotiations between a Canadian company and Dharma, a ransomware gang, in 2018.

Targeting ransomware negotiators

It’s not illegal in the US to pay a ransom to hackers, as long as they don’t belong to the ransomware groups currently sanctioned by Washington or any other government.

ShinyHunters isn’t on the list, but the FBI issued a May alert advising victims not to pay the group, as it doesn’t actually destroy or return the stolen data. The information is often kept, resold, or used for further extortion.

In recent months, the US Department of Justice has been acting more aggressively and going after fishy ransomware negotiators.

On October 7th, the DoJ charged MonsterCloud CEO Zohar Pinhasi with wire fraud and conspiracy for allegedly charging customers to remediate ransomware attacks without paying the hackers.

Pinhasi allegedly secretly went behind his customers’ backs and paid hackers anyway, paying ransomware groups $8 million while charging customers $19 million.

And in July, Angelo Martino, a 41-year-old ransomware negotiator, was sentenced to 70 months in prison for conspiring with the Blackcat/ALPHV ransomware group to extort multiple victims.