Source: Krebs on Security
Author: BrianKrebs
URL: https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/
ONE SENTENCE SUMMARY:
Investigators linked ShinyHunters to negotiators and consultants, exposing conflicts, alleged collusion, and intensified FBI action including FBI theft.
MAIN POINTS:
- ShinyHunters has claimed dozens of breaches since 2019 and extorted over $70 million.
- Leadership shifted to “Rey,” a teenage hacker from Amman, after prior French arrests.
- Late September hack of fbijobs.gov stole personnel medical, SSN, address, and unit data.
- Jordan detained Rey, reportedly cooperating, as FBI rapidly pursued anyone communicating with suspects.
- Dutch police arrested Pepijn van der Stap while logged into Signal, exposing key contacts.
- Seized messages allegedly revealed ransomware negotiators knew victims before victims learned breaches.
- Canadian executive Edward Dubrovsky was arrested for extortion-related charges; case records sealed.
- Investigators suspect a U.S. consulting executive helped operate ShinyHunters’ “shinywire” extortion site.
- “Ghostbyte” nickname and email traces tied Daniel Tobok to earlier Dharma ransomware mediation lore.
- DOJ cases highlight negotiators allegedly deceiving clients or conspiring to maximize ransom outcomes.
TAKEAWAYS:
- Conflicted fee models (percentage-of-ransom) can incentivize negotiators to favor attackers’ outcomes.
- Paying ransoms cannot verify data deletion, enabling repeat or downstream extortion attempts.
- Communications seized during arrests can rapidly map ecosystems of facilitators around extortion groups.
- Third-party incident response and insurance-directed vendors require rigorous oversight to prevent collusion.
- Prosecutions increasingly target intermediaries, not only hackers, for fraud, conspiracy, and extortion conduct.