US federal investigators suspect an executive at an American consulting firm helped operate a website used by ShinyHunters to extort companies, according to an October 19 report by KrebsOnSecurity.
Two sources close to the inquiry told the publication that investigators believe the unidentified executive helped run shinywire.com. The report also described unusually close relationships between ShinyHunters and executives at two ransomware negotiation firms.
The website operated from approximately May 3 to October 16, naming nearly 100 organisations as alleged ShinyHunters victims. Its pages displayed samples of purportedly stolen files and urged companies to negotiate payments. Those refusing to engage within seven days were warned that their data would be published on a separate website. The entries do not independently establish that every claimed breach occurred.
According to a source cited by Krebs, Dutch authorities were able to read Signal messages after arresting suspected ShinyHunters associate Pepijn van der Stap on September 15. The source said the messages showed frequent contact with Canadian ransomware negotiator Edward Dubrovsky and an executive at the unnamed American firm.
The source alleged that the executives sometimes knew details of breaches before the victims themselves. The messages have not been publicly released, and these allegations remain independently unverified.
The same source alleged that Dubrovsky knew ShinyHunters had stolen sensitive FBI information before the group threatened to publish it, but did not warn the bureau.
Dubrovsky was arrested in Pennsylvania on October 8 on federal extortion-related charges. As TheZeal previously reported, the underlying complaint remains sealed. An October 9 court order directed his transfer to the Eastern District of Texas. He has not been convicted.
His former employer, CYPFER, confirmed that he left the company in December 2025. A spokesperson told KrebsOnSecurity that CYPFER learned of his arrest through media reports and had received no contact from law enforcement at the time.
Ransomware negotiators legitimately represent victims facing extortion demands. Secretly assisting criminals instead would present a serious conflict of interest. Neither the American executive's alleged involvement nor Dubrovsky's alleged advance knowledge of the FBI data theft has been established in court.
