FBI Suspects Cybersecurity Executive Helped ShinyHunters Run Extortion Website

Federal investigators suspect an executive at a United States consulting firm helped ShinyHunters operate a website used to pressure hacked companies into paying ransom demands.

The allegation raises questions about whether trusted ransomware advisers crossed from helping victims into supporting the criminals demanding payment for stolen data.

The suspected website operator has not been publicly named or charged. Separately, the FBI arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, on October 8 in Pennsylvania. Reporting does not establish that Dubrovsky operated the website, and allegations against him remain unproven as the federal investigation continues into his conduct.

The website, shinywire[.]com, reportedly operated from approximately May 3 through October 16, 2026. It listed nearly 100 organizations targeted by ShinyHunters. Each listing encouraged the victim to contact the group, discuss payment terms, and avoid the release of stolen information, according to sources familiar with the continuing federal investigation.

Shinywire Turned Stolen Files Into Payment Pressure

Victim pages displayed samples of stolen files to support the demands. Organizations that did not engage within seven days reportedly faced publication of their data on a separate ShinyHunters leak site accessible through Tor. This setup used public exposure and deadlines to push companies toward negotiations with the hacking group.

KrebsOnSecurity cited two sources who said investigators believe an executive at a large American consulting firm actively helped run Shinywire. The publication withheld the executive’s identity and the company’s name because no charges had been filed. It described the firm as having more than 1,000 associates across its consulting business.

Dubrovsky’s arrest forms another part of the investigation. As covered in Cybersecurity News’ earlier report, he faces allegations involving a conspiracy to threaten the release of confidential information for money and interference with commerce through threats. The sealed complaint limits public scrutiny of the conduct prosecutors attribute to the Canadian executive.

The public court docket records his arrest and subsequent commitment to the Eastern District of Texas. It also shows that federal defenders were appointed and detention was ordered pending a hearing in the charging district. Those procedural records do not establish guilt or reveal the full evidence behind the allegations against him.

Investigators reportedly gained leads after Dutch police arrested ShinyHunters suspect Pepijn van der Stap in September. Sources told KrebsOnSecurity that officers accessed recent Signal conversations while he was logged in. Those messages allegedly revealed frequent contact with Dubrovsky and an executive at the unnamed American firm now under scrutiny.

According to the reporting, some exchanges suggested the executives knew details about new ShinyHunters victims before those organizations discovered their breaches. Another allegation is that Dubrovsky knew sensitive FBI information had been stolen before the group publicly threatened its release. These claims come from sources, not publicly tested court evidence.

The investigation gained urgency after ShinyHunters targeted the FBI’s recruitment website in September. Reportedly stolen records included Social Security numbers, home addresses, medical information, and details about employee assignments. The sensitivity of those files increased the stakes beyond a standard corporate breach and placed additional pressure on investigators pursuing suspects.

ShinyHunters commonly steals credentials through phishing and uses compromised accounts to take data from cloud services. It then threatens publication unless victims pay. This is extortion based on stolen information, which does not require encrypting a victim’s computers. According to KrebsOnSecurity, the FBI attributes more than $70 million in 2026 payments to the group.

The case also highlights the risks of trusting promises to delete stolen records. In the PowerSchool breach and extortion case, a payment of approximately $2.85 million did not prevent later demands targeting affected school districts. Subsequent attempts used information from the same breach, showing how stolen records can remain a continuing source of pressure.

KrebsOnSecurity also reported concerns about negotiators whose fees rise with the final ransom payment. CyberAcuView chief executive Mark Camillo said that arrangement creates conflicting interests because the adviser benefits from a larger payment. He called for greater transparency around fees, cryptocurrency costs, and the financial interests involved in settling demands.

The FBI’s May 15 ShinyHunters advisory warned that attackers may combine stolen information with threatening messages, calls, and harassment. It advised people contacted directly not to pay or respond to demands. The bureau also urged victims to preserve communications and report suspected activity through IC3 or an FBI field office.

For now, the website allegation remains a reported investigative finding involving an unnamed executive, while Dubrovsky faces separate criminal proceedings. Neither should be presented as a conviction. Public filings and further evidence will be needed to establish who supported ShinyHunters, what they did, and whether their actions broke the law.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post FBI Suspects Cybersecurity Executive Helped ShinyHunters Run Extortion Website appeared first on Cyber Security News.