Federal investigators, in their pursuit of the **ShinyHunters** hacking group, have reportedly identified executives at two separate ransomware negotiation firms maintaining unusually close ties with the extortionists. Sources close to the investigation indicate that one U.S. executive allegedly aided **ShinyHunters** in managing a website designed to pressure victims into paying ransoms. Since 2019, **ShinyHunters** has claimed responsibility for dozens of significant data breaches. Initially operated by cybercriminals in France, the group's control eventually shifted to a teenage hacker from Amman, Jordan, known as **Rey**. The **FBI** estimates that **ShinyHunters** has extorted over $70 million from victims this year alone. ### FBI Jobs Site Compromised In late September, **ShinyHunters** successfully breached the **FBI**'s recruitment website, **fbijobs.gov**. The group subsequently taunted the agency with threats to publish stolen files, which reportedly included highly sensitive information such as medical and psychological records, Social Security numbers, home addresses, and details about employees' units and specializations. This high-profile hack prompted the **FBI** to act with unusual speed, leading to arrests, detentions, and questioning of individuals who had communicated with **Rey** or other **ShinyHunters** suspects. **Reuters** reported on October 3 that **Rey** had been detained by Jordanian authorities and was cooperating with the **FBI**. ### Arrests and Revelations **Rey**'s ascension to control of the hacking group followed the apprehension of one of its alleged senior members, **Pepijn van der Stap**. On the evening of September 15, 2026, Dutch authorities arrested **Van der Stap**, reportedly using flash-bang grenades as he was logged into various online accounts. According to an investigative source, authorities accessed **Van der Stap**'s **Signal** instant messaging account during his arrest, revealing recent communications with frequent contacts, including ransomware negotiators based in Canada and the United States. Multiple sources informed KrebsOnSecurity that **Van der Stap**'s messages were crucial in uncovering a murder-for-hire plot that emerged immediately after his arrest. The Dutch news outlet **RTL** reported that two murders were allegedly ordered to be committed abroad, with indications that **Van der Stap** gave the command, though there is no evidence the orders were carried out. On October 9, the **FBI** arrested 54-year-old Canadian cybersecurity executive **Edward Dubrovsky** in connection with the **ShinyHunters** investigation. **Dubrovsky**, who recently authored a book on cyber extortion recommending engagement with hackers, faces charges of threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion, as per court records. **Politico** reported that prosecutors have requested **Dubrovsky** remain in custody and that case records remain sealed. An investigative source revealed that **Van der Stap**'s **Signal** messages showed frequent conversations with **Mr. Dubrovsky** and at least one executive at a large U.S.-based consulting firm. These executives allegedly possessed details about new **ShinyHunters** victims even before the victims themselves were aware of the breach. Even more disturbingly, federal investigators reportedly found that **Mr. Dubrovsky** was aware of **ShinyHunters**' theft of highly sensitive data from **FBI** servers but failed to inform the bureau prior to the group's public threats on **Twitter/X** to publish the agency's deeply personal personnel files. ## SHINYWIRE **FBI** investigators believe at least one executive at a U.S.-based consulting firm actively participated in operating the now-defunct **ShinyHunters** victim extortion website, "**shinywire[.]com**." While the U.S. company and suspected executive(s) have not yet been charged, the firm is described as prestigious, with over 1,000 associates.  The **Shinywire** website was active from approximately May 3, 2026, to October 16, featuring nearly 100 organizations targeted by **ShinyHunters**. Each entry urged victims to engage with the cybercrime group and negotiate payment. The pages also displayed samples of stolen files, threatening publication if demands were ignored.  Organizations that refused to engage or negotiate within seven days would find all their stolen data published on the **ShinyHunters** victim shaming blog, accessible only via the **Tor** anonymity network. **The Globe and Mail** reported on October 15 that a few months before his arrest, **Edward Dubrovsky** alleged in court documents that he was collateral damage in a campaign by a former business partner to "destroy" another industry executive. **Dubrovsky** filed a lawsuit in Ontario against **Daniel Tobok**, former CEO of **Cypfer**, a cybersecurity firm. The two, who co-developed **Cypfer**, had a falling out in 2024, with **Dubrovsky** accusing **Tobok** of exclusion and capricious business decisions. **Mr. Tobok** denied the allegations, filing a counterclaim accusing **Mr. Dubrovsky** of accessing confidential information and unfairly competing through another firm, **CyberSteward Inc**. He also stated that **Mr. Dubrovsky** misrepresented himself as a **Cypfer** founder and is not a shareholder. ## GHOSTBYTE Interviews with former colleagues of **Mr. Tobok** reveal that as far back as eight years ago, he was known to ransomware purveyors by the nickname: **Ghostbyte**.