Feds: Ransom Negotiator Operated ShinyHunters Extortion Site
Federal Investigators Suspect Ransom Negotiator Operated ShinyHunters Extortion Portal
U.S. federal investigators pursuing the ShinyHunters hacking group have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion syndicate, krebsonsecurity.com reported. Sources close to the investigation state that a U.S.-based executive allegedly helped ShinyHunters operate a website designed to pressure victims into paying extortion demands.
The Tech TL;DR:
- Federal investigators discovered that executives at ransomware negotiation firms allegedly maintained deep ties with the ShinyHunters extortion syndicate.
- The now-defunct extortion portal shinywire.com listed nearly 100 corporate victims from May through October 2026.
The Dutch Arrest That Unraveled the Extortion Operation
The investigation accelerated on the evening of September 15, 2026, when authorities in the Netherlands arrested convicted hacker and ShinyHunters suspect Pepijn van der Stap. Dutch police utilized flash-bang grenades to stun Van der Stap while he remained logged into active online accounts. A source close to the investigation revealed that authorities apprehended him while he was using his Signal instant messaging account, granting investigators immediate access to recent communications with frequent contacts, including ransomware negotiators stationed in Canada and the United States.
Those Signal messages exposed frequent conversations between Van der Stap and Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, alongside at least one executive at a large U.S.-based consulting firm. According to sources with knowledge of the matter, these executives routinely possessed details about fresh ShinyHunters breaches before the targeted organizations even realized they had been compromised. Investigators discovered that Dubrovsky knew ShinyHunters had stolen highly sensitive data from FBI servers following a late September breach of fbijobs.gov, yet never notified the bureau prior to the hackers publicly threatening to release personnel files.
From Signal Chats to the Shinywire Extortion Infrastructure
Two sources close to the probe confirmed that federal investigators believe at least one executive at a U.S.-based consulting firm with over 1,000 associates played an active role in operating the now-defunct victim extortion website shinywire.com. Operating from approximately May 3, 2026, until October 16, the site featured entries for nearly 100 organizations breached by ShinyHunters. Each entry displayed samples of stolen files and pushed victims to negotiate payment terms.
Victim organizations that refused to engage within seven days faced the publication of their stolen data on the ShinyHunters shaming blog hosted on the Tor anonymity network. The extortion pressure tactics directly collided with established incident response firms that advise clients against paying. Chat logs reviewed by investigators revealed intense frustration from ShinyHunters leaders regarding firms like Coveware actively discouraging victims from paying ransoms.
Legal Actions and Ongoing Industry Scrutiny
On October 9, krebsonsecurity.com broke the news that the FBI arrested Edward Dubrovsky in connection with the probe. Court records show Dubrovsky was charged with threatening to disclose hacked data and interfering with interstate commerce through extortion. Meanwhile, Reuters reported on October 3 that a teenage hacker from Amman, Jordan, known as “Rey”—who assumed control of the ShinyHunters brand following earlier arrests—had been detained by Jordanian authorities and was cooperating with the FBI.
Frequently Asked Questions About the ShinyHunters Investigation
When was the shinywire.com extortion portal active?
The website operated from approximately May 3, 2026, until October 16, 2026, listing nearly 100 organizations targeted by the ShinyHunters hacking group.
Who was arrested in connection with the U.S. federal probe?
The FBI arrested 54-year-old Canadian cybersecurity executive Edward Dubrovsky on October 9, 2026, charging him with extortion and interfering with interstate commerce.
How did law enforcement access the communications linking negotiators to the hackers?
Dutch police arrested Pepijn van der Stap on September 15, 2026, while he was actively logged into his Signal account, allowing investigators to read direct messages exchanged with international ransomware negotiators.
Disclaimer: The technical analyses and security protocols detailed in this article are for informational purposes only. Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.