# Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

> U.S. federal investigators identify ransomware negotiator linked to ShinyHunters extortion site.
- Title: Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
- Summary: U.S. federal investigators identify ransomware negotiator linked to ShinyHunters extortion site. FBI arrested Canadian cybersecurity executive Edward…
- Keywords: shinyhunters, fbi, edward dubrovsky, cybersecurity, ransomware, extortion, shinywire, cypfer, cybersteward, power school, coveware, unit 221b
- Source: Krebsonsecurity — https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site
- Published: 2026-10-19T15:20:28+00:00
- Read time: 2 min
- Topics: shinyhunters, fbi, edward dubrovsky, cybersecurity, ransomware, extortion, shinywire, cypfer, cybersteward, power school, coveware, unit 221b
## Feds identify ransom negotiator
U.S. federal investigators identified executives at two ransomware negotiation firms who maintained close relations with ShinyHunters extortion group.
## ShinyHunters extorted $70m
ShinyHunters has extorted more than $70 million from victims so far this year according to FBI reports.
## FBI hacks recruitment site
ShinyHunters hacked the FBI recruitment website fbijobs.gov and threatened to publish stolen medical and social security records.
## Rey assumed control
Rey, a teenage hacker from Amman, Jordan, assumed control of ShinyHunters after key members were arrested.
## Dutch arrest of Van der Stap
Dutch police arrested Pepijn van der Stap on September 15, 2:00 p.m. using flash-bang grenades while he was logged in to online accounts.
## Signal messages reveal connections
Van der Stap’s Signal messages showed frequent conversations with Edward Dubrovsky and a U.S. consulting firm executive.
## Dubrovsky arrested by FBI
FBI arrested Canadian cybersecurity executive Edward Dubrovsky on October 9 for helping ShinyHunters operate extortion websites.
## Shinywire extortion site
Shinywire.com operated from May 3 to October 16 and listed nearly 100 organizations hacked by ShinyHunters.
## Shinywire demands payment
Shinywire urged victims to engage with ShinyHunters and discuss ransom terms for payment of stolen data.
## PowerSchool ransom payment
PowerSchool paid $2.85 million to ShinyHunters after stealing data from 62 million students and 9.5 million teachers.
## ShinyHunters threats to victims
ShinyHunters threatened to publish stolen data of victims who refused to negotiate within seven days.
## Coveware advises against payment
Coveware warned victims against paying ShinyHunters after the group threatened their staff with legal action.
## ShinyHunters attacks Coveware
ShinyHunters complained on Telegram that Coveware was harming their payment rates by advising victims not to pay.
## Ghostbyte connection
Mr. Tobok, a former Cypfer executive, was known as Ghostbyte to ransomware groups for helping victims negotiate payments.
## Cypfer and CyberSteward
Cypfer and CyberSteward are separate companies with no officers, directors or employees in common.
## ShinyHunters' next move
ShinyHunters will continue extorting victims using stolen data after initial ransom payments.
## Key takeaway

FBI arrested Canadian cybersecurity executive Edward Dubrovsky for helping ShinyHunters operate a victim extortion website that extorted over $70 million from victims.