Federal investigators pursuing the ShinyHunters hacking group have identified executives at two different ransomware negotiation firms who maintained close ties with the extortion syndicate, with sources telling KrebsOnSecurity that a U.S.-based executive allegedly helped operate the criminal group’s public pressure portal.
Signal Messages and the Arrest of Pepijn van der Stap
The federal scrutiny intensified following a late-night raid in Europe. On September 15, 2026, authorities in the Netherlands arrested convicted hacker and ShinyHunters suspect Pepijn van der Stap using flash-bang grenades to stun him while he was actively logged into his online accounts. Sources close to the investigation confirmed to KrebsOnSecurity that the Dutch police seized control of Van der Stap’s Signal instant messaging account during the apprehension. This allowed investigators to read real-time communications with frequent contacts, including ransomware negotiators based in the United States and Canada.
Those encrypted message logs revealed an immediate operational nexus between the core hackers and high-ranking incident response professionals. According to investigative findings, Van der Stap maintained frequent chats with Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive. The messaging data showed that Dubrovsky possessed advance knowledge of the ShinyHunters breach targeting FBI servers well before the group publicly taunted the agency on Twitter/X, yet never alerted law enforcement.
On October 9, 2026, federal agents arrested Dubrovsky. Court records show he was charged with threatening to disclose hacked data and interfering with interstate commerce through extortion. Prosecutors subsequently requested that Dubrovsky remain in custody pending trial, keeping related court records under seal, as reported by Politico.
Further compounding the evidentiary trail from Van der Stap’s device, Dutch news outlet RTL reported that the encrypted chats contained indications pointing toward a connected murder-for-hire plot directed abroad, though there is no indication those attacks were ever carried out.
The Rise and Fall of the Shinywire Extortion Portal
Beyond private messaging channels, federal investigators uncovered active infrastructure collusion. Sources close to the probe told KrebsOnSecurity that at least one executive at a prominent U.S.-based consulting firm with more than 1,000 associates played an active role in operating shinywire.com. This now-defunct extortion website was active from May 3, 2026, until October 16, hosting profiles for nearly 100 corporate victims.
The site functioned as an aggressive pressure funnel. Victims listed on the portal were urged to engage with the cybercrime syndicate and discuss payment terms. The pages featured samples of stolen files, accompanied by explicit warnings that data would be published on the Tor-based ShinyHunters shaming blog if demands were ignored for seven days.
Among the indexed entries was Intuitive Surgical, an American medical technology company breached in March 2026 after an employee fell for a targeted phishing email that compromised corporate credentials. Despite the scale of these operations, ShinyHunters faced friction from legitimate security firms that actively counseled corporate clients against giving in to extortion demands.
Friction With Incident Response and Industry Conflicts
The extortion syndicate repeatedly expressed frustration over security firms disrupting their monetization models. Internal Telegram chats reviewed by investigators show ShinyHunters leaders complaining in April and May 2026 that firms like Coveware were actively advising victims not to pay, thereby harming the group’s payment rates. In one private exchange, the group’s main account administrator declared an intent to eliminate Coveware as an operational hurdle.
This dynamic highlights broader structural conflicts within the incident response ecosystem.
Federal authorities have increasingly targeted this gray market. In July, ransomware negotiator Angelo Martino was sentenced to 70 months in prison for conspiring with the Blackcat/ALPHV group to leak client negotiation strategies and maximize payouts.
Unresolved Questions in the Ongoing Extortion Probe
- Who operated Shinywire? While federal investigators suspect at least one executive at a major U.S. consulting firm helped run the extortion domain, authorities have not yet publicly named or formally charged the individual.
- What is the status of Rey? Reuters reported on October 3, 2026, that “Rey”—identified as a teenage hacker from Amman, Jordan who took over the ShinyHunters brand following earlier arrests—had been detained by Jordanian authorities and was cooperating with the FBI.
- How will consulting and negotiation fee structures change?
