The unnamed US executive is separate from Canadian ransomware negotiator Edward Dubrovsky, who was arrested on federal extortion charges.
US federal investigators suspect executives at two ransomware negotiation firms maintained unusually close relationships with ShinyHunters, including one executive who allegedly helped operate the group’s victim-extortion website.
The findings were reported by Brian Krebs of KrebsOnSecurity today, citing sources close to the federal investigation. The report does not identify the US consulting company or the executive suspected of helping run the site because no charges have been announced against them.
Investigators are also examining the conduct of Canadian ransomware negotiator Edward Dubrovsky, who was arrested in Pennsylvania on October 8 on federal cyber extortion and conspiracy charges. His criminal complaint remains sealed, and the specific allegations underlying those charges have not been released publicly.
Investigators Examine Shinywire Operations
The website under investigation, shinywire.com, operated from about May 3 until October 16, 2026. Its homepage displayed a message for companies that had received an extortion email from ShinyHunters, directing them to use the unique link included in the message.
According to Krebs, the site hosted individual extortion pages associated with nearly 100 organisations. The report does not say that the homepage publicly named or listed those victims.
A cached page reviewed by Krebs concerned Intuitive Surgical, a US medical technology company breached in March 2026 after an employee entered credentials through a targeted phishing email. The page encouraged the company to contact ShinyHunters, displayed samples of allegedly stolen files and warned that its data could be published if it did not respond.
Those victims who did not begin negotiations within seven days could later have their stolen information published through ShinyHunters’ Tor-based leak site. Shinywire was used to communicate demands through private links, while the Tor site was used to release data.
Krebs also reported that investigators believe at least one executive from a large US consulting firm took an active role in operating Shinywire. The company reportedly employs more than 1,000 people but has not been named.
The allegation comes from sources familiar with the investigation. The suspected executive has not been publicly identified or charged, and federal authorities have not released evidence explaining the alleged role.
Messages Reportedly Exposed Negotiator Contacts
Investigators reportedly gained access to recent Signal messages when Dutch police arrested convicted hacker and suspected ShinyHunters member Pepijn van der Stap on September 15.
According to Krebs’s sources, those messages showed frequent conversations between van der Stap, Dubrovsky and at least one executive at the unnamed US consulting firm. The executives allegedly knew details about new ShinyHunters victims before some of the affected organisations learned they had been breached.
One source also claimed Dubrovsky knew ShinyHunters had stolen sensitive FBI personnel data but did not notify the bureau before the group threatened to publish it.
Dubrovsky has not been convicted, and the sealed court record does not publicly confirm these claims. Court filings show that he faces allegations involving conspiracy to impair the confidentiality of information for extortion and interference with commerce through threats.
CYPFER, where Dubrovsky worked from May 2022 until December 2025, has said he served as a managing director and was never a founder or co-founder. He later became associated with CyberSteward, which provides ransomware negotiation and cyber extortion services.
Arrests Follow FBI Jobs Portal Breach
The investigation accelerated after ShinyHunters claimed responsibility for breaching the FBI jobs portal and obtaining personal, medical and employment information belonging to bureau personnel and applicants.
A missed security update reportedly left the Oracle PeopleSoft system exposed, after which the FBI removed a contractor from the assignment. Accenture was later identified as the company managing the platform.
Jordanian authorities had already detained suspected ShinyHunters member Saif al-Din Khader, known online as Rey, on September 29. He was reportedly cooperating with US investigators. The FBI later confirmed multiple arrests but declined to identify every suspect.
The bureau says ShinyHunters has obtained more than $70 million from victims during 2026.
Ransomware Negotiation Firms Face New Scrutiny
Companies hit by data breaches or ransomware attacks often hire negotiators to communicate with attackers, test their claims and reduce payment demands. That access can place negotiators close to victim information, payment decisions and criminal operators.
The ShinyHunters investigation now asks whether people trusted to represent victims also assisted the group pressuring them. Investigators have not publicly established how many negotiators are under examination or whether more charges will follow.
The case follows the separate prosecution of MonsterCloud CEO Zohar Pinhasi, who is accused of secretly paying attackers for decryption keys while charging customers much higher recovery fees. Pinhasi has not been convicted.
Neither case proves misconduct throughout the ransomware negotiation industry. Both cases, however, place the financial relationships between victims, negotiators and cybercriminals under closer examination.
