From Krebsonsecurity · · 2m
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
U.S. federal investigators identify ransomware negotiator linked to ShinyHunters extortion site.
In brief
U.S. federal investigators identify ransomware negotiator linked to ShinyHunters extortion site. FBI arrested Canadian cybersecurity executive Edward Dubrovsky for helping ShinyHunters operate a victim extortion website that extorted over $70 million from victims. Originally reported by Krebsonsecurity.
Feds identify ransom negotiator
U.S. federal investigators identified executives at two ransomware negotiation firms who maintained close relations with ShinyHunters extortion group.
ShinyHunters extorted $70m
ShinyHunters has extorted more than $70 million from victims so far this year according to FBI reports.
FBI hacks recruitment site
ShinyHunters hacked the FBI recruitment website fbijobs.gov and threatened to publish stolen medical and social security records.
Rey assumed control
Rey, a teenage hacker from Amman, Jordan, assumed control of ShinyHunters after key members were arrested.
Dutch arrest of Van der Stap
Dutch police arrested Pepijn van der Stap on September 15, 2:00 p.m. using flash-bang grenades while he was logged in to online accounts.
Signal messages reveal connections
Van der Stap’s Signal messages showed frequent conversations with Edward Dubrovsky and a U.S. consulting firm executive.
Dubrovsky arrested by FBI
FBI arrested Canadian cybersecurity executive Edward Dubrovsky on October 9 for helping ShinyHunters operate extortion websites.
Shinywire extortion site
Shinywire.com operated from May 3 to October 16 and listed nearly 100 organizations hacked by ShinyHunters.
Shinywire demands payment
Shinywire urged victims to engage with ShinyHunters and discuss ransom terms for payment of stolen data.
PowerSchool ransom payment
PowerSchool paid $2.85 million to ShinyHunters after stealing data from 62 million students and 9.5 million teachers.
ShinyHunters threats to victims
ShinyHunters threatened to publish stolen data of victims who refused to negotiate within seven days.
Coveware advises against payment
Coveware warned victims against paying ShinyHunters after the group threatened their staff with legal action.
ShinyHunters attacks Coveware
ShinyHunters complained on Telegram that Coveware was harming their payment rates by advising victims not to pay.
Ghostbyte connection
Mr. Tobok, a former Cypfer executive, was known as Ghostbyte to ransomware groups for helping victims negotiate payments.
Cypfer and CyberSteward
Cypfer and CyberSteward are separate companies with no officers, directors or employees in common.
ShinyHunters' next move
ShinyHunters will continue extorting victims using stolen data after initial ransom payments.
The essence
FBI arrested Canadian cybersecurity executive Edward Dubrovsky for helping ShinyHunters operate a victim extortion website that extorted over $70 million from victims.
