FBI suspects a ransom negotiator ran ShinyHunters extortion site
Original title: Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
Sources say an unnamed US consulting executive helped run shinywire.com; that person has not been charged.
KrebsOnSecurity reports that investigators believe an executive at a large US consulting firm helped operate shinywire.com, a ShinyHunters extortion site active from about May 3 to October 16 with nearly 100 victim entries. Canadian executive Edward Dubrovsky was arrested October 9 and charged with extortion-related offenses after chats tied to the September 15 arrest of Pepijn van der Stap in the Netherlands. According to the FBI, ShinyHunters has extorted more than $70 million this year, including a late-September hack of fbijobs.gov.
Unconfirmed: The US executive's role and the murder-for-hire allegations come from sources and have not been charged or shown as carried out.
- Krebs is not naming the US firm or executive because they are not charged.
- Shinywire urged payment and posted stolen-file samples, then data went to a Tor blog.
- Intuitive Surgical was listed after a March 2026 phishing email stole credentials.
- Reuters reported on October 3 that Rey was detained in Jordan and cooperating.
- Prosecutors have asked that Dubrovsky remain in custody; related records are sealed.
Impact: Extortion using stolen data, including claimed FBI personnel files
- ATT&CK
- T1566 Phishing
- Threat actors
- ShinyHunters
- Victims
- FBIIntuitive Surgical
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | shinywire.com | ing the now-defunct ShinyHunters victim extortion website “ shinywire[.]com .” KrebsOnSecurity is not naming the U.S. company or the |
From the original article
11 min read at krebsonsecurity.com
U. S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned.
By BrianKrebs · krebsonsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.