Thought Leadership
According to KrebsOnSecurity, a consultant who represented victims in extortion cases allegedly co-operated the hacker group’s leak site.
In the investigation into the hacker group ShinyHunters, professionals who advise companies on negotiations with extortionists are coming under scrutiny. According to security journalist Brian Krebs, FBI investigators believe that executives at two ransom negotiation firms cooperated with the group. At least one of them, a manager at a US consulting firm with more than 1,000 employees, was allegedly actively involved in operating the extortion site Shinywire. He has not been indicted to date.
Shinywire was online from May to October 2026 and listed nearly 100 organizations that ShinyHunters had attacked. The entries urged the victims to establish contact, negotiate payment terms, and pay ransoms.
Canadian Manager Indicted
On October 9, the FBI announced the arrest of a 54-year-old Canadian cybersecurity executive, Edward Dubrovsky. According to court documents, he is accused of threatening to publish stolen data and interfering with interstate commerce through extortion. He had previously published a book on handling cyber extortion in which he recommends always communicating with the attackers. According to investigators, he was aware of the attack on the FBI but did not inform the bureau before ShinyHunters threatened to publish the data. He is presumed innocent.
Trail via Signal Chats
According to KrebsOnSecurity, the starting point of the investigation was the arrest of Dutch suspect Pepijn van der S. in Amsterdam on September 15. Police obtained access to his accounts and reviewed Signal messages in which he communicated with ransom negotiators in Canada and the United States. According to a source cited by Krebs, the messages document frequent conversations with Dubrovsky and at least one other executive.
“These executives often knew about new ShinyHunters victims before the victims themselves had learned of the breach.”
KrebsOnSecurity
Following the arrest in the Netherlands, Jordanian teenager Saif al-Din Khader, alias “Rey,” took over the ShinyHunters brand, according to Krebs. The attack on the FBI reportedly took place under his leadership. He was arrested in Jordan in late September and is cooperating with the FBI, according to Reuters.
Justice Department Cracks Down on Negotiators
The US Department of Justice is increasingly cracking down on ransom negotiators. On October 7, the owner of service provider MonsterCloud was indicted for allegedly secretly paying extortionists while falsely claiming to clients that proprietary decryption technology was being used. In July, a negotiator who extorted victims in collusion with the ransomware group BlackCat/ALPHV was sentenced to 70 months in prison. Ransom payments are not fundamentally prohibited in the US, provided the recipients are not sanctioned entities. However, the FBI advised against paying ShinyHunters in May, stating that the group does not delete stolen data.
(Editorial Team)
