U.S. federal investigators pursuing ShinyHunters, the group that recently stole sensitive data from the FBI’s recruitment site, have identified executives at two ransomware-negotiation firms who kept unusually close relations with the extortion group, KrebsOnSecurity reports, citing sources close to the investigation. One of the U.S.-based executives is suspected of helping ShinyHunters operate a website that pressured victims into paying.
That site, “Shinywire,” was active from about May 3 until October 16 and listed nearly 100 hacked organizations. Each entry urged the victim to engage with the group and discuss payment terms, included samples of stolen files, and promised publication if the victim ignored the demand; victims who did not negotiate within seven days would see their data posted on the group’s Tor-based leak blog. Krebs says it is not naming the consulting firm (described as prestigious, with more than 1,000 associates) or the executive because neither has been charged.
The reporting builds on the September 15 arrest of suspected ShinyHunters member Pepijn van der Stap in the Netherlands, whose Signal messages investigators were able to read. A source told Krebs those chats showed frequent conversations with Edward Dubrovsky, a Canadian cybersecurity executive the FBI arrested in connection with the case, and with at least one executive at a large U.S. consulting firm, who often knew about new victims before the victims did. Dubrovsky was charged with threatening to disclose stolen data and interfering with interstate commerce, per court records; prosecutors have asked that he stay in custody pending trial. Another source claimed his chats showed he knew ShinyHunters had taken sensitive FBI data and did not tell the bureau before the group threatened to publish it. The allegations come from anonymous sources and unproven charges, and none of those named have been convicted. For earlier coverage of the group’s leadership change, see ShinyHunters leader reportedly detained in Jordan.