FBI Finds Ties Between Ransomware Group and Negotiation Firm Executives

Federal investigators have identified potential criminal links between the ShinyHunters ransomware group and executives at two ransomware negotiation firms, according to a KrebsOnSecurity report published on October 19. The inquiry suggests that trusted intermediaries may have actively assisted the extortion group rather than merely negotiating on behalf of victims. This development raises serious concerns about the integrity of the ransomware negotiation industry and the potential for insider collaboration with criminal organizations.

Who is accused of helping the group?

Sources familiar with the ongoing investigation told KrebsOnSecurity that an executive from an unnamed US consulting company allegedly assisted in operating the ShinyHunters victim extortion website. The firm reportedly employs more than one thousand associates. Authorities have not charged the suspected executive, so KrebsOnSecurity withheld the company’s identity. The allegations remain under active investigation and have not been proven in court.

How did the investigation progress?

The probe gained significant momentum after authorities arrested suspected ShinyHunters member Pepijn van der Stap in the Netherlands on September 15. Law enforcement detained him while his Signal account remained accessible. Investigators reviewed recent conversations, including exchanges with ransomware negotiators in Canada and the United States. These messages indicated frequent communication between the hacker and the executives, revealing a direct channel for coordination.

What did the accused do?

According to sources, the accused negotiators knew details about some ShinyHunters victims before those organizations realized they had been breached. Canadian cybersecurity executive Edward Dubrovsky, 54, was arrested and charged with threatening to disclose stolen information and interfering with interstate commerce through extortion. Prosecutors sought to keep him detained. One source claimed Dubrovsky knew about stolen FBI data before the group publicly threatened its release but did not warn the bureau.

How did the extortion site operate?

Investigators believe an executive from the American consulting firm helped operate shinywire.com, an extortion portal active from May 3 to October 16, 2026. The now-defunct site listed nearly one hundred organizations targeted by ShinyHunters. It combined samples of stolen data with demands for victims to negotiate payments. Organizations that failed to respond within seven days risked having their stolen datasets published on the group’s separate Tor-accessible leak blog.

What analysts watch for

Teams usually examine communication logs for early knowledge of breaches that precedes victim notification. Analysts check whether negotiation intermediaries share victim details with threat actors before official contact. They monitor for unauthorized access to extortion portals or leak sites by trusted third parties. Investigators also review financial flows to detect payments that bypass standard negotiation channels. Security teams should verify that any external negotiator has no prior ties to known criminal groups before engaging their services.

What to do and how to stay safe: ShinyHunters

• Verify the background and professional history of any ransomware negotiation firm before hiring them to handle an incident.
• Assume that stolen data may be known to third parties before your organization is notified, and prepare for public disclosure.
• Monitor for new extortion portals or leak sites that list your organization as a target, even if you have not been contacted.
• Report any suspicious communication from negotiators who possess detailed breach information before you do to law enforcement.

Step-by-step guide: Ransomware Incident Response: 6 Common Misreadings Corrected

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who was arrested in this investigation?

Pepijn van der Stap, a suspected ShinyHunters member, was arrested in the Netherlands, and Edward Dubrovsky was arrested and charged in the US.

What charges was Edward Dubrovsky facing?

He was charged with threatening to disclose stolen or hacked information and interfering with interstate commerce through extortion.

What website was allegedly operated by a consulting firm executive?

An executive allegedly helped operate shinywire.com, an extortion portal that listed targeted organizations and samples of stolen data.