Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

U.S. investigators allege senior executives at two ransomware negotiation firms had unusually close ties to ShinyHunters, and that one executive helped operate the group’s extortion site SHINYWIRE.COM, which ran from about May 3 to October 16 and listed nearly 100 victim organizations while pressuring them to negotiate payments. ShinyHunters, whose control shifted to a teen known as REY after earlier members - including Pepijn van der Stap - were arrested, has claimed dozens of breaches and is accused of extorting more than $70 million this year. A high-profile breach of the FBI recruitment site that exposed medical, psychological and Social Security data accelerated arrests and detentions; Dutch police say van der Stap’s Signal messages linked him to negotiators in Canada and the U.S., revealed knowledge of victims before they were notified, and helped uncover an alleged murder-for-hire plot. Canadian executive Edward Dubrovsky was arrested Oct. 9 and charged with threatening to disclose stolen data and extortion-related interference; investigators say his messages showed prior knowledge of the FBI breach.

The reporting connects another industry figure, Daniel Tobok (nicknamed “Ghostbyte”), to historical ransomware mediation contacts and traces of interactions with Dharma affiliates, though direct criminal charges for him have not been disclosed. A notable prior case involved PowerSchool, where a $2.85 million ransom was reportedly paid with help from CyberSteward yet stolen records resurfaced in later extortion attempts, underscoring that payments cannot guarantee deletion or exclusive control of stolen data. The probe highlights conflicts of interest in incident response and negotiation services, insurers’ influence on victim choices, and ongoing sealed court proceedings.