Feds Allege Ransom Negotiator Ran ShinyHunters Site

FBI investigators have linked executives at two ransomware negotiation firms to ShinyHunters’ extortion infrastructure, according to a Krebs on Security investigation published October 19.

Arrest. Edward Dubrovsky, 54, Cypfer’s managing partner and COO, was arrested October 9. Charges: threatening to disclose stolen data; interfering with interstate commerce through extortion. Krebs reports he is the unnamed co-conspirator referenced in earlier bureau announcements. Not confirmed by the bureau in filings reviewed by this desk. Treat accordingly.

The shinywire connection. The group’s data leak site ran May 3 to October 16, 2026. It listed nearly 100 breached organizations and imposed a seven-day payment deadline. FBI investigators believe an executive at a U.S. consulting firm, more than 1,000 associates, operated the site. That person has not been charged.

Signal intercepts from Pepijn van der Stap, a senior ShinyHunters member arrested by Dutch authorities September 15, show regular contact between Dubrovsky and the unnamed U.S. executive. Confirmed: both knew about new ShinyHunters victims before notifications went out. Confirmed: Dubrovsky knew about the FBI breach before ShinyHunters threatened publication and did not inform the bureau.

Ghostbyte. Sources tell Krebs that Cypfer co-founder and former CEO Daniel Tobok used the handle in ransomware circles for at least eight years. A 2018 Dharma ransomware email directed victims to contact “ghostbyte@tutanota.com.” Tobok’s personal email links to two accounts using that name. He has not responded to requests for comment. Unconfirmed, treat accordingly.

ShinyHunters admin Rey, based in Amman, Jordan, was detained by Jordanian authorities October 3 and is cooperating with FBI.

Scope. The group extorted more than $70 million in 2026. The FBI breach, late September 2026, hit fbijobs.gov and exposed medical and psychological records, Social Security numbers, home addresses, and employee unit information.

Negotiation firms charging a percentage of final ransom payments face a structural conflict with their clients. CyberAcuView CEO Mark Camillo: “It has come to the industry’s attention that many of the ransomware payers charge a percentage of the final payment which may or may not be disclosed.”

Source: Krebs on Security, October 19, 2026.

Related: Ransomware Consultant Arrested in FBI Hack Probe | FBI Arrests ShinyHunters Suspect in FBI Breach Case