US Ransomware Negotiator Suspected of Assisting ShinyHunters Extortion Operation

Federal investigators are examining whether a US ransomware negotiator secretly helped the ShinyHunters cybercrime group operate an extortion website used to pressure nearly 100 victim organizations.

Sources say the unnamed executive, who works for a large US consulting firm, maintained unusually close contact with ShinyHunters and may have played an active role in running the group’s portal, shinywire.com. The site, active from early May until October 16, directed victims to unique links included in extortion emails and hosted private pages showing samples of allegedly stolen data and warnings that information would be leaked if companies failed to respond.

The investigation is separate from the case of Canadian ransomware negotiator Edward Dubrovsky, arrested in Pennsylvania on October 8 on federal cyber extortion and conspiracy charges. His complaint remains sealed, and the specific allegations have not been made public. Investigators reportedly gained access to Signal messages after Dutch police arrested convicted hacker and suspected ShinyHunters member Pepijn van der Stap on September 15. Those messages allegedly showed frequent conversations between van der Stap, Dubrovsky, and the US executive, including knowledge of new victims before some organizations realized they had been breached.

One source claims Dubrovsky knew ShinyHunters had stolen sensitive FBI personnel data but did not notify the bureau before the group threatened to publish it. Dubrovsky previously worked as a managing director at CYPFER and later became associated with CyberSteward, which offers ransomware negotiation and cyber extortion services. He has not been convicted, and the sealed court record does not confirm the claims described by investigators.

The probe intensified after ShinyHunters claimed responsibility for breaching the FBI jobs portal and stealing personal, medical, and employment information belonging to bureau personnel and applicants. Multiple suspects, including Jordanian national Saif al‑Din Khader, have been detained, and the FBI says ShinyHunters has obtained more than $70 million from victims in 2026.

Ransomware negotiation firms are now facing new scrutiny. Organizations often hire negotiators to communicate with attackers, verify stolen data, and reduce payment demands, placing them close to victim information and criminal operators. The ShinyHunters case raises the question of whether people trusted to represent victims may have instead assisted the group pressuring them. It follows the separate prosecution of MonsterCloud CEO Zohar Pinhasi, accused of secretly paying attackers for decryption keys while charging clients far higher recovery fees. Neither case proves misconduct across the entire industry, but both highlight growing concern over the financial relationships between victims, negotiators, and cybercriminals.