Federal investigators probing the ShinyHunters hacking group have identified executives at two ransomware negotiation firms who maintained unusually close ties to the extortion operation, according to KrebsOnSecurity. The group recently breached the FBI's recruitment website, fbijobs.gov, stealing sensitive personnel files. Investigators suspect at least one U.S.-based executive helped run Shinywire, a now-defunct site that pressured nearly 100 victim organizations into paying ransoms.
Shinywire was active from May to October 2026 and listed organizations breached by ShinyHunters, threatening to publish stolen files if victims did not engage. The FBI believes an executive at a prestigious U.S. consulting firm with more than 1,000 associates played an active role in operating the site, though the firm and executive have not been charged. The investigation was aided by the September arrest of Dutch hacker Pepijn van der Stap, whose Signal messages revealed frequent contact with negotiators, including Canadian cybersecurity executive Edward Dubrovsky.
Dubrovsky was arrested on October 9 and charged with threatening to disclose stolen data and extortion. According to investigators, his chats showed he knew ShinyHunters had stolen FBI data and did not alert the bureau before the group threatened to publish it. ShinyHunters has extorted more than $70 million this year, and its suspected leader, Rey, a teenager from Jordan, has been detained and is cooperating with the FBI.