While pursuing the ShinyHunters hacking group, the FBI found unusually close ties between ShinyHunters and executives at two ransomware negotiation firms, one of whom allegedly helped run the group's extortion website.
As the FBI chased the ShinyHunters group that stole sensitive data from its own recruitment site, investigators turned their attention to an unexpected crowd: consultants paid to negotiate with hackers on behalf of victims.
Two ransomware negotiation firms had executives who were far too close to the hacking group. One U.S.-based executive allegedly helped run shinywire.com, the site ShinyHunters used to pressure victims into paying. The site ran from May to October 2026 and listed nearly 100 victims, each told to contact the hackers within days or have their stolen files published.
A Dutch hacker's phone cracked the case
Dutch police arrested Pepijn van der Stap mid-session in September while he was logged into his accounts. His Signal messages led straight to negotiation executives in Canada and the U.S.
Those executives often knew details about new ShinyHunters victims before the victims themselves had learned of the breach. More explosive: van der Stap's chats showed Edward Dubrovsky knew ShinyHunters had stolen highly sensitive data from FBI servers and never reported it.
Dubrovsky, a Canadian cybersecurity executive, was arrested on October 9 and charged with threatening to disclose stolen data and interfering with interstate commerce through extortion. He had recently published a book advising victims to always engage with hackers.
Why it matters
The conflict of interest in ransomware negotiation has long been an open secret: negotiators paid a percentage of the ransom have every incentive to push the price up. This case shows the extreme end of that spectrum — negotiators actively participating in the extortion, turning a service meant for victims into a harvest for the criminals.
Curated from high-quality sources, with concise summaries and key takeaways.
