Cybersecurity
Investigators probe ShinyHunters ties to ransomware firms
Sources told KrebsOnSecurity that federal investigators examining ShinyHunters had identified executives at two ransomware negotiation firms, and one executive was said to have helped run an extortion website.
- Federal investigators were pursuing ShinyHunters after the group hacked the FBI recruitment site and threatened to publish stolen material.
- Sources told KrebsOnSecurity that investigators had identified executives at two ransomware negotiation firms who had unusually close ties to the group.
- One source said an executive in the United States had helped operate a site used to pressure victims into paying.
- Dutch authorities arrested Pepijn van der Stap on 15 September 2026, and investigators reportedly used his Signal messages to review contacts in Canada and the United States.
- The FBI arrested Edward Dubrovsky on 9 October 2026, and Cypfer said it had not received law-enforcement outreach.
Federal investigators were pursuing ShinyHunters after the group hacked the FBI recruitment site and threatened to release files said to include staff records. The article said Reuters reported that Rey had been detained in Jordan and was cooperating with the FBI.
A source close to the case said van der Stap’s Signal messages gave investigators recent exchanges with frequent contacts, including ransomware negotiators based in Canada and the United States. Those messages were said to point to Edward Dubrovsky and to an executive at a large U.S. consulting firm.
The article said investigators believed one executive at that consulting firm helped run the victim-extortion site Shinywire, which operated from early May until 16 October. It said the site listed nearly 100 breached organisations, invited them to negotiate payment and warned that stolen files would be posted if they did not respond.
The report also said Dubrovsky was arrested on 9 October and charged in relation to the ShinyHunters probe. Cypfer denied prior knowledge of the arrest and denied contact from law enforcement, while the article noted earlier disputes involving Daniel Tobok, CyberSteward and Apros Group.
Named in this story
People
- Rey
- the alleged ShinyHunters leader said to have been detained in Jordan and cooperating with the FBI
- Pepijn van der Stap
- the convicted hacker and ShinyHunters suspect arrested in the Netherlands
- Edward Dubrovsky
- the Canadian cybersecurity executive arrested by the FBI in the probe
- Daniel Tobok
- the former chief executive of Cypfer and a party to earlier business disputes with Dubrovsky
- Jason Hogg
- the Apros Group leader identified as a former FBI special agent
Companies
- Cypfer
- the cybersecurity firm that denied prior knowledge of Dubrovsky’s arrest
- CyberSteward Inc.
- the firm linked to Dubrovsky in the article
- Apros Group
- the holding company that acquired Cypfer
- Aon Cyber Solutions Group
- the company where Jason Hogg had been chief executive
- Cytelligence
- the security consulting firm acquired by Aon in 2020
- Intuitive Surgical
- the medical technology company shown as a Shinywire victim example
- PowerSchool
- the education technology company extorted by ShinyHunters in 2024
- Coveware
- the incident response firm that advised victims against paying ShinyHunters
- Unit 221B
- the incident response firm that also warned against paying ShinyHunters
- Constella Intelligence
- the breach-tracking service cited for linking email and wallet data
Organisations
- ShinyHunters
- the hacking group under federal investigation for extortion and data theft
- Dharma
- the ransomware affiliate programme that dealt with a Canadian victim in 2018
Governments and agencies
- FBI
- the bureau whose recruitment site was hacked and whose investigators were involved
Places
- Jordan
- the country where Rey was reported to have been detained
- Netherlands
- the country where van der Stap was arrested
How the source tells it
The piece was an investigative report with a cautious, sometimes dramatic register, using section headings and loaded details to heighten the stakes while grounding most claims in sourced allegations.
- alarm the article stacked FBI data theft, arrests and alleged murder plotting into a crisis sequence
- suspense anonymous sourcing and a delayed reveal about which executives were implicated created a reveal-driven narrative
- moral framing a section on conflicting interests cast the negotiations business as an ethical dispute