Feds suspect ransom negotiator ran ShinyHunters site
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
FBI arrested Canadian cybersecurity executive Edward Dubrovsky, 54, in Pennsylvania on cyber extortion charges.
Investigators suspect ransomware negotiators had close ties to the hacking group.
Background
ShinyHunters is a hacking group that has claimed dozens of major data breaches since 2019 and recently stole data from the FBI. Edward Dubrovsky is a 54-year-old Canadian cybersecurity executive who recently published a book on handling cyber extortion recommending always engaging with the hackers. The scrutiny intensified after ShinyHunters hacked the FBI recruitment site fbijobs.gov in late September and threatened to publish stolen files, prompting the bureau to move with uncommon speed against people in contact with the group.
How it unfolded
- May 3, 2026ShinyHunters' victim extortion website, shinywire.com, began operating.
- Sep 15, 2026Dutch authorities arrested convicted hacker and ShinyHunters suspect Pepijn van der Stap while he was logged in to online accounts including Signal.
- Sep 29, 2026"Rey" (Saif al-Din Khader), a teenage hacker from Amman, Jordan, was taken into custody in Jordan and began cooperating.
- Oct 8, 2026The FBI arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in Pennsylvania on federal cyber extortion and conspiracy charges.
- Oct 16, 2026shinywire.com ceased operating.
- Oct 19, 2026KrebsOnSecurity reported, citing sources close to the investigation, that investigators suspect executives at two ransomware negotiation firms had unusually close relations with ShinyHunters, including one US executive who allegedly helped operate the extortion site.
Who’s saying what
- Analysts
- KrebsOnSecurity, citing sources close to the investigation, reported that one US executive helped ShinyHunters operate a website that pressured victims into paying ransom, and that negotiators often knew details of new victims before the victims themselves did.
- Caution
- Cyber Security News noted the reporting does not establish that Dubrovsky operated the website, that the allegations remain unproven, and that the claims come from sources rather than publicly tested court evidence.
- Official
- The FBI, per KrebsOnSecurity, said ShinyHunters has extorted more than $70 million from victims so far this year.
Still unverified
The US consulting company and the executive suspected of helping run the site are not identified because no charges have been announced; Cybernews reported that online breadcrumbs lead to Daniel Tobok, former chief executive of Toronto-based Cypfer. Dubrovsky's criminal complaint remains sealed and the specific allegations have not been released publicly. RTL reported indications Van der Stap gave orders for two murders abroad, with no indication the orders were ever carried out.