US federal investigators have identified executives at two ransomware negotiation firms with unusually close ties to the ShinyHunters extortion group, and at least one US-based executive allegedly helped operate the group’s victim extortion site, according to an investigative report that cites sources close to the investigation. No one has been charged in connection with that allegation.
Allegations Against Negotiation Firm Executives
The report says the executive in question is unnamed and uncharged. The person is separate from Edward Dubrovsky, a Canadian negotiator who was arrested in Pennsylvania on October 8 on federal cyber extortion and conspiracy charges. The complaint against Dubrovsky is sealed.
The FBI investigation is ongoing, and no charges against the unnamed US executive have been announced. The allegation raises conflict-of-interest concerns for victims who hired negotiators to deal with ShinyHunters.
The shinywire.com Extortion Site
The site, shinywire.com, ran from about May 3 until October 16, 2026. It hosted extortion pages for nearly 100 organizations, including a cached page for Intuitive Surgical, which was breached in March 2026 through phishing. Victims that did not negotiate within seven days faced threats of publication.
ShinyHunters Pressure Builds Through Arrests and Disruptions
The report places the allegation within a run of recent developments around the group. ShinyHunters hacked fbijobs.gov in late September. The FBI says the group has extorted more than $70 million this year.
Arrests and Reported Cooperation
Dutch police arrested a suspect, Pepijn van der Stap, on September 15. Reuters reported on October 3 that a Jordanian teenager known as “Rey,” identified as Saif al-Din Khader, had taken over the ShinyHunters brand and was reportedly detained and cooperating with investigators.
The shape of the allegation is distinct from the criminal cases reported so far. Dubrovsky faces federal charges for cyber extortion and conspiracy. The unnamed executive, by contrast, is described as having helped operate the extortion site, which would place a negotiation-industry professional on the group’s side of the process.
The account of the site’s operation adds detail. Victims that did not start negotiating within seven days faced publication of their data, and the site carried pages for nearly 100 organizations over about five and a half months. The cached page for Intuitive Surgical, which was breached through phishing in March 2026, is one example of how the site presented victims.
Timeline of the ShinyHunters Investigation
The events run in a short span. Van der Stap was arrested on September 15. The fbijobs.gov hack followed in late September. Dubrovsky was arrested on October 8, and shinywire.com went offline on October 16. The investigative report was published on October 19.
What the Allegation Means for Ransomware Negotiation
Ransomware negotiators act as intermediaries between victims and attackers, which gives them access to sensitive details of an incident, including what a victim is willing to pay. The allegation that executives at two firms had close ties to the group, and that one helped run the site that pressured victims, would, if proven, mean that some victims were negotiating with people connected to the extortionists.
The report does not name the two firms. It does not say whether the firms themselves knew of the alleged activity or whether victims of the extortion site included clients of those firms. The overlap between the site’s seven-day negotiation deadline and a negotiator’s role in setting the pace of talks is among the questions that investigators will probably examine, though the reporting does not address it directly.
The investigative report rests on sources close to the investigation, and it does not name the two negotiation firms or the executive. The FBI has not announced charges against the unnamed US executive. The report’s account of the site’s lifespan, from about May 3 to October 16, places its shutdown eight days after Dubrovsky’s arrest in Pennsylvania.
For now the case rests on unnamed sources and a sealed complaint in a related prosecution. Federal prosecutors have not publicly described any connection between the Dubrovsky case and the unnamed executive, and the FBI has not commented in the material reviewed.
