The cybersecurity industry's dirtiest open secret just became a federal case. U.S. investigators pursuing the ShinyHunters hacking group — which stole personnel files from the FBI's own recruitment site — have identified executives at two ransomware negotiation firms who maintained suspiciously close relationships with the extortion group. One executive, the feds believe, actively helped operate ShinyHunters' victim-shaming website. The structural conflict of interest is breathtaking: firms paid to negotiate ransoms on behalf of victims were allegedly feeding intelligence to the attackers and running their infrastructure. The dominoes started falling on September 15, 2026, when Dutch police used flash-bang grenades to arrest convicted hacker Pepijn van der Stap while he was logged into his Signal account. That arrest gave investigators access to his recent messages, revealing frequent communications with ransomware negotiators in Canada and the United States. Those messages showed the negotiators often knew about new ShinyHunters victims before the victims themselves had learned of the breach — a detail that transforms "close relationship" into something that looks like operational collaboration. On October 9, the FBI arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive who had literally published a book recommending that victims always engage with hackers. Dubrovsky was charged with threatening to disclose stolen data and interfering with interstate commerce through extortion. Van der Stap's Signal chats allegedly showed Dubrovsky knew ShinyHunters had stolen sensitive FBI personnel data — medical records, psychological evaluations, Social Security numbers, home addresses, unit assignments — and never informed the bureau. The investigation's most explosive thread leads to a U.S.-based consulting firm with more than 1,000 associates. FBI investigators believe at least one executive there played an active role in operating Shinywire, ShinyHunters' extortion website that was active from May to October 2026. The site listed nearly 100 hacked organizations, pressured victims to engage and pay, and published stolen data samples as leverage. KrebsOnSecurity has not named the firm or executive because no charges have been filed. A parallel trail connects to Daniel Tobok, former CEO of Cypfer, a cybersecurity firm with offices across five countries. Former colleagues say Tobok was known to ransomware operators as "Ghostbyte" as far back as eight years ago. In 2018, the Dharma ransomware group explicitly directed a Canadian victim to contact the email address ghostbyte@tutanota.com for "guarantees" on ransom payments. Breach-tracking service Constella Intelligence links Tobok's known email to accounts using the username "ghostbyte," including a Snapchat account. The Dharma representative's own email is associated with a cryptocurrency wallet that processed 43 bitcoin — roughly $3.5 million at current value. The Van der Stap arrest also uncovered an alleged murder-for-hire plot. Dutch outlet RTL reported the two murders were to be committed abroad and that Van der Stap apparently gave the order, though there is no indication the orders were carried out. ShinyHunters, meanwhile, has extorted more than $70 million from victims so far this year. Its teenage current leader, "Rey," was detained by Jordanian authorities in early October and is cooperating with the FBI. Cypfer issued a statement denying involvement in ransomware payments and claiming no prior knowledge of Dubrovsky's arrest. The firm noted it was recently acquired by Apros Group, led by Jason Hogg, a former FBI special agent. The layered corporate structures — Cypfer, CyberSteward, Cytelligence, Aon — and the revolving door between law enforcement and the ransomware negotiation industry illustrate exactly why this sector has become a regulatory blind spot. The people paid to protect victims had every incentive to ensure the attacks kept coming.
