Feds suspect US consulting executive helped run ShinyHunters extortion site

KrebsOnSecurity reports that US federal investigators pursuing ShinyHunters, the group that recently stole sensitive data from the FBI, have identified executives at two ransomware negotiation firms who kept unusually close relations with the extortion group. Two sources close to the probe told Brian Krebs's site that FBI investigators believe at least one executive at a US-based consulting firm played an active role in operating shinywire[.]com, the now-defunct ShinyHunters victim extortion website. The site's operators are described as pressuring victims into paying. KrebsOnSecurity is not naming the firm or the suspected executive(s) because they have not been charged with a crime. It describes the firm only as prestigious, with more than 1,000 associates.

The background: ShinyHunters has claimed credit for dozens of major breaches since 2019, when the group was mainly run by cybercriminals in France. As those members were arrested or jailed, control of the brand passed to "Rey", identified last year as a teenage hacker from Amman, Jordan. The FBI says the group has extorted more than $70 million from victims so far this year. In late September it hacked the FBI recruitment site fbijobs.gov and threatened to publish the stolen files, which reportedly included medical and psychological records, Social Security numbers, home addresses and details of each employee's unit and specialization. The FBI has since moved with unusual speed to arrest, detain and question people who communicated with Rey or other suspects. Reuters reported on October 3 that Jordanian authorities had detained Rey and that he was cooperating with the FBI.

The investigative thread runs through Pepijn van der Stap, a convicted hacker and ShinyHunters suspect arrested in the Netherlands on the evening of September 15, 2026. Dutch police reportedly used flash-bang grenades. According to a source, he was logged in to Signal at the time, so authorities could read his recent chats with frequent contacts, including ransomware negotiators in Canada and the United States. Multiple sources say those messages were key to unraveling a murder-for-hire plot that emerged right after his arrest. RTL reported that the two murders were allegedly to be carried out abroad and that there are indications Van der Stap gave the order; there is no indication the orders were carried out.

On October 9, KrebsOnSecurity broke the news that the FBI had arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the investigation. Court records say he was charged with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion. Dubrovsky recently published a book on handling cyber extortion that recommended always engaging with the hackers. Politico reports prosecutors want him held pending trial and that his case records remain under seal. A source said Van der Stap's Signal messages showed frequent conversations with Dubrovsky and with at least one executive at a large US consulting firm, and that these executives often knew details of new victims before the victims learned of the breach. The same source said the chats showed Dubrovsky knew ShinyHunters had stolen sensitive data from FBI servers and never told the bureau before the group threatened on Twitter/X to publish the personnel files.

Shinywire was active from about May 3, 2026 until October 16 and had entries for nearly 100 organizations. Each entry urged the victim to engage and discuss payment terms, included samples of stolen files and promised publication if the victim ignored the demands. One example is Intuitive Surgical, a US medical technology company breached in March 2026 after an employee fell for a targeted phishing email. Victims that refused to engage or negotiate after seven days had all their stolen data posted on the group's Tor-only shaming blog.

The article then turns to Cypfer, a cybersecurity firm founded in Toronto with offices in the US, Britain, the Netherlands, the UAE and Mexico. In a story published October 15, The Globe and Mail reported that Dubrovsky, formerly managing partner and chief operating officer at Cypfer, sued its former chief executive Daniel Tobok in Ontario this year. Dubrovsky alleged he had become collateral damage in a campaign by a former business partner to "destroy" another industry executive, and that Tobok had gradually excluded him after a 2024 falling out. Tobok reportedly denied the allegations and filed a counterclaim accusing Dubrovsky of accessing confidential information and unfairly competing through another firm, CyberSteward Inc. He also said Dubrovsky misrepresented himself as a Cypfer founder and is not a shareholder.

Krebs then reports that, according to several former colleagues of Tobok, he was known to ransomware operators as far back as eight years ago by the nickname Ghostbyte. In 2018 a Canadian company hit by the Dharma ransomware program said it was leaning toward paying but wanted a guarantee. The Dharma representative's reply pointed the victim to a Canadian IT firm and the address ghostbyte@tutanota.com: "If you want guarantees, you can write to the IT company." It is unclear whether Tobok ever used that address, and he has not responded to requests for comment. Breach-tracking service Constella Intelligence finds that an email address Tobok often uses is linked to two accounts, including a Snapchat account, with the username "ghostbyte". Constella also links the Dharma rep's email address to a crypto address that processed 38 transactions totaling 43 bitcoin (about $3.5 million at the time of writing; last transaction February 2019).

In a statement shared on October 14, Cypfer said its business does not include making or facilitating ransomware payments, that it learned of Dubrovsky's arrest from the media, and that CyberSteward and Cypfer are separate companies with no officers, directors or employees in common. It added that Cypfer was recently acquired by the Apros Group, led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. In 2020 Aon acquired Cytelligence, a consulting firm where Tobok was founder and CEO and Dubrovsky a managing partner.

Krebs closes the section on the wider economics. Paying a ransom is not illegal in the US, and ShinyHunters is not sanctioned by the US or any other government. Insurers typically steer victims to a specific response firm; firms that refuse to facilitate payments get replaced once a victim decides to pay. PowerSchool, which ShinyHunters began extorting in December 2024 (62 million students and 9.5 million teachers in the US and Canada), reportedly paid a $2.85 million ransom and says it was assisted by CyberSteward. Extortion with the same data resumed by May 2025, when school districts reportedly got separate demands. Affiliate Matthew Lane, 20, of Sterling, Mass., was sentenced in November 2025 to four years in prison for his role. Coveware and Unit 221B have warned victims against paying ShinyHunters, and the FBI issued an alert to the same effect on May 15, 2026. ShinyHunters members have meanwhile harassed and threatened employees at both firms for that advice.

Key facts

• Two sources say FBI investigators believe at least one executive at an unnamed, uncharged US consulting firm (more than 1,000 associates) played an active role in running the Shinywire extortion site.
• Shinywire ran from about May 3 to October 16, 2026, with entries for nearly 100 organizations; victims who did not engage within seven days had data published on a Tor shaming blog.
• Leads came from Signal messages of arrested suspect Pepijn van der Stap; the FBI arrested Canadian executive Edward Dubrovsky, 54, who is charged with threatening to disclose stolen data and interfering with interstate commerce through extortion.
• The FBI says ShinyHunters has extorted more than $70 million this year, after the group hacked fbijobs.gov in late September.
• Cypfer says it is not the target of any law enforcement investigation and that it does not make or facilitate ransomware payments.

Why it matters

If the sources are right, the line between ransomware response and ransomware operation has been crossed from the inside: someone paid to help victims negotiate may have helped run the pressure campaign against them. ShinyHunters has extorted more than $70 million this year according to the FBI, and its hack of the FBI's own recruitment site pushed investigators to act fast. The Signal messages recovered from Van der Stap's arrest are what tie negotiators in Canada and the US to the group, and they reportedly show executives knowing about victims before the victims did.

Who it affects

Organizations that have been or could be extorted by ShinyHunters, including the nearly 100 listed on Shinywire. FBI employees whose records were reportedly in the stolen jobs-site data. Ransomware negotiation and incident response firms, whose clients rely on them in the middle of a crisis. Insurers who steer victims to particular response firms. Cypfer, Dubrovsky and Tobok are named in the reporting, but the consulting firm and the suspected Shinywire executive(s) are not named.

How to use it

For security and risk teams, the practical takeaways come from the source's context. The FBI alert of May 15, 2026 and incident response firms Coveware and Unit 221B all advise against paying ShinyHunters, because "destroyed" data is often kept, resold or used to extort clients later. PowerSchool's case is the example: after its reported $2.85 million payment, school districts received separate demands using the same data. Paying is not illegal in the US and ShinyHunters is not sanctioned, but there is no technical way to verify that stolen data was deleted. Krebs notes that firms unwilling to facilitate payments are replaced once a victim decides to pay.

How solid is it

The central claim rests on two unnamed sources close to the investigation, relayed by KrebsOnSecurity, and is described as the belief of FBI investigators, not a charge or a finding. Some details are better documented: Dubrovsky's charges come from court records, and the Rey detention is attributed to Reuters. The Ghostbyte link rests on former colleagues' interviews, an email-to-username association from Constella Intelligence and a 2018 Dharma reply. Krebs says it is unclear whether Tobok ever used the address. The murder-for-hire detail comes from multiple sources and RTL.

Risks and caveats

Nobody beyond Dubrovsky is reported as charged, and the source does not say Dubrovsky is the executive suspected of operating Shinywire. It also does not say that Cypfer or CyberSteward is the firm behind the site, or that Tobok is accused of any crime. Cypfer denies any law enforcement contact. Tobok reportedly denies Dubrovsky's lawsuit allegations and has not responded to Krebs. Dubrovsky's case records are reportedly sealed, and the murder-for-hire plot has no indication of being carried out. Treat names and links as allegations.

“CYPFER has not received any outreach from law enforcement and, to our knowledge, is not the target of any law enforcement investigation.”

— A Cypfer spokesperson, in an email to KrebsOnSecurity