/
← Voltar ao feed
medium government healthcare education cybersecurity

FBI probes suspected ties between ransomware negotiators and ShinyHunters extortion; Canadian executive Edward Dubrovsky charged

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 02:42 · coletado há 21 horas

Federal investigators examining ShinyHunters have uncovered potential links between the extortion group and executives at two ransomware negotiation firms, according to a KrebsOnSecurity report published on October 19. An executive at an unnamed U.S. consulting firm (reportedly 1,000+ employees) allegedly helped operate the group's extortion portal shinywire.com. The firm has not been named because no charges have been filed against the suspected executives. Canadian cybersecurity executive Edward Dubrovsky, 54, was arrested and charged with threatening to disclose stolen or hacked information and interfering with interstate commerce through extortion. These charges are allegations, not findings of guilt. The case highlights the risk of conflicts of interest among intermediaries paid a percentage of ransom amounts.

Technical Details

  • Dutch authorities arrested suspected ShinyHunters member Pepijn van der Stap on September 15 while his Signal account was still accessible. Investigators reviewed his chats with negotiators in Canada and the U.S.
  • The messages reportedly showed frequent contact with Dubrovsky and at least one executive at the U.S. firm. The negotiators allegedly knew details of some victims before those victims knew they were breached.
  • One source claimed Dubrovsky knew of stolen FBI data before ShinyHunters publicly threatened to leak it and did not notify the bureau.
  • shinywire.com was active from about May 3 to October 16, 2026 and listed nearly 100 targeted organizations. It combined stolen data samples with payment negotiation demands. Victims who did not respond within seven days risked publication on the group's separate Tor leak blog.
  • A cached listing targeted Intuitive Surgical, which reported a March 2026 incident in which a phishing email compromised an employee's credentials. This is an example of data extortion without encryption.
  • The late-September breach of fbijobs.gov reportedly exposed medical and psychological information, Social Security numbers, addresses and personnel assignment details. Reuters reported that Jordanian authorities detained ShinyHunters operator "Rey", who was cooperating with the FBI.
  • PowerSchool reportedly paid $2.85 million via CyberSteward after its December 2024 breach, then faced further demands over the same records. The report does not attribute the second wave to ShinyHunters.
  • Cypfer, Dubrovsky's former firm, said it does not facilitate ransom payments, had no prior knowledge of his arrest, and shares no officers, directors or employees with CyberSteward.

Remediation

  • Organizations engaging negotiators should vet intermediaries and seek transparency on fee structures. Percentage-based fees can incentivize larger payments.
  • Enforce phishing-resistant MFA and monitor for credential compromise, since stolen credentials alone can fuel data extortion.
  • Do not assume payment guarantees deletion of stolen data, as repeat extortion over the same records has occurred.

Linha do tempo

  1. gbhackers.com ↗ · pub. 20/10/2026 02:42 · coletado 20/10 03:00 primeiro registro

    FBI probes suspected ties between ransomware negotiators and ShinyHunters extortion; Canadian executive Edward Dubrovsky charged

    ler a análise desta fonte

    Federal investigators examining ShinyHunters have uncovered potential links between the extortion group and executives at two ransomware negotiation firms, according to a KrebsOnSecurity report published on October 19. An executive at an unnamed U.S. consulting firm (reportedly 1,000+ employees) allegedly helped operate the group's extortion portal shinywire.com. The firm has not been named because no charges have been filed against the suspected executives. Canadian cybersecurity executive Edward Dubrovsky, 54, was arrested and charged with threatening to disclose stolen or hacked information and interfering with interstate commerce through extortion. These charges are allegations, not findings of guilt. The case highlights the risk of conflicts of interest among intermediaries paid a percentage of ransom amounts.

    Technical Details

    • Dutch authorities arrested suspected ShinyHunters member Pepijn van der Stap on September 15 while his Signal account was still accessible. Investigators reviewed his chats with negotiators in Canada and the U.S.
    • The messages reportedly showed frequent contact with Dubrovsky and at least one executive at the U.S. firm. The negotiators allegedly knew details of some victims before those victims knew they were breached.
    • One source claimed Dubrovsky knew of stolen FBI data before ShinyHunters publicly threatened to leak it and did not notify the bureau.
    • shinywire.com was active from about May 3 to October 16, 2026 and listed nearly 100 targeted organizations. It combined stolen data samples with payment negotiation demands. Victims who did not respond within seven days risked publication on the group's separate Tor leak blog.
    • A cached listing targeted Intuitive Surgical, which reported a March 2026 incident in which a phishing email compromised an employee's credentials. This is an example of data extortion without encryption.
    • The late-September breach of fbijobs.gov reportedly exposed medical and psychological information, Social Security numbers, addresses and personnel assignment details. Reuters reported that Jordanian authorities detained ShinyHunters operator "Rey", who was cooperating with the FBI.
    • PowerSchool reportedly paid $2.85 million via CyberSteward after its December 2024 breach, then faced further demands over the same records. The report does not attribute the second wave to ShinyHunters.
    • Cypfer, Dubrovsky's former firm, said it does not facilitate ransom payments, had no prior knowledge of his arrest, and shares no officers, directors or employees with CyberSteward.

    Remediation

    • Organizations engaging negotiators should vet intermediaries and seek transparency on fee structures. Percentage-based fees can incentivize larger payments.
    • Enforce phishing-resistant MFA and monitor for credential compromise, since stolen credentials alone can fuel data extortion.
    • Do not assume payment guarantees deletion of stolen data, as repeat extortion over the same records has occurred.