IC Technology & Cyber — 2026-10-20

FBI Identifies US Consulting Firm Executive Who Operated ShinyHunters Extortion Site

BLUFIt is unlikely that federal prosecutors publicly charge the unnamed executive by November 30, 2026, as the sealed Dubrovsky docket signals a sequenced prosecution strategy that will keep cooperating-witness leverage intact before expanding indictments.

KrebsOnSecurity reported on October 19, citing two sources close to the probe, that FBI investigators believe at least one executive at an unnamed US consulting firm with more than 1,000 associates helped operate shinywire.com, an extortion site active from about May 3 to October 16 with pages for nearly 100 victims 12. Neither the firm nor the executive has been charged or named 12. Krebs's sources said Signal messages recovered when Dutch police arrested suspect Pepijn van der Stap on September 15 showed frequent contact with both that executive and Canadian executive Edward Dubrovsky, who allegedly knew of new victims before the victims did 13. Dubrovsky, 54, was arrested in Pennsylvania and charged in the Eastern District of Texas with extortion conspiracy and Hobbs Act interference; his complaint remains sealed 24.

Analysis
Confidence is moderate, resting on a single primary account from Krebs on Security. Hackread, GBHackers and BleepingComputer add no independent sourcing on the shinywire role, and no court filing or DOJ statement names the executive. The new reporting moves beyond last week's Cypfer co-founder arrest to a second, uncharged executive and Signal evidence tying both men to Van der Stap. It is unlikely that US federal authorities publicly charge or name the unnamed consulting firm executive tied to shinywire.com by November 30, 2026. Prosecutors already hold the sealed Dubrovsky complaint and the Signal material, so they can build a case without a public filing. Dubrovsky's custody and the sealed docket suggest the Eastern District of Texas is sequencing defendants. Frequent contact and advance knowledge of victims may also reflect ordinary negotiator access to breach details rather than operation of the site. Negotiation firms with large rosters should expect subpoenas and internal reviews well before any charge, while insurers and victim counsel have no defensible basis to suspend engagements over an unnamed allegation.

4 sources

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site - Krebs on Security
US Ransomware Negotiator Suspected of Helping ShinyHunters Extort Victims - Hackread
FBI Uncovers Suspected Links Between Ransomware Negotiators and ShinyHunters Hackers - GBHackers
Cyber exec arrested in case allegedly tied to ShinyHunters hackers - BleepingComputer