A US investigation into the ShinyHunters cybercrime group has raised allegations that cybersecurity professionals hired to handle ransomware incidents may have secretly assisted the hackers. Federal investigators reportedly suspect executives associated with two negotiation firms of maintaining close relationships with the group, including one individual who allegedly helped operate its extortion website.
According to an investigation published by KrebsOnSecurity, FBI officials believe an executive at a major US consulting company participated in managing Shinywire, a website used by ShinyHunters to pressure organizations into paying ransom demands. The platform operated between May and October 2026 and listed nearly 100 alleged victims, displaying stolen information and threatening further disclosures.
The suspected executive has not been publicly identified or charged. The allegations are based on information attributed to sources familiar with the federal investigation, rather than findings established in court.
The investigation gained momentum following the September 15 arrest of Pepijn van der Stap, a convicted hacker suspected of involvement with ShinyHunters. Dutch authorities reportedly obtained access to his Signal communications, uncovering conversations with ransomware negotiators in the United States and Canada.
Those communications allegedly revealed that certain negotiators received information about cyberattacks before the affected organizations became aware of them. Investigators are examining whether those relationships went beyond legitimate negotiations and involved cooperation with the criminals.
On October 9, US authorities arrested Canadian cybersecurity executive Edward Dubrovsky. He faces charges involving threats to disclose stolen information and extortion affecting interstate commerce. Sources cited by KrebsOnSecurity also allege that Dubrovsky knew about ShinyHunters’ theft of sensitive FBI information before the group publicly threatened to release it.
The investigation follows the hacking group’s reported compromise of FBI recruitment systems in September. Authorities subsequently detained another suspected ShinyHunters figure in Jordan, who reportedly began cooperating with US investigators.
The case has also brought renewed attention to financial incentives within the ransomware negotiation industry. Some companies charge fees based on the final ransom payment, potentially creating conflicts between the interests of victims and those handling negotiations.
Federal prosecutors have pursued other cases involving alleged misconduct by ransomware negotiators. In October, MonsterCloud chief executive Zohar Pinhasi was charged with fraud-related offenses over allegations that his company secretly paid attackers while charging customers for services presented differently.