FBI probe of ShinyHunters examines ransomware negotiators accused of close ties to the extortion group

KrebsOnSecurity reports that U.S. investigators probing ShinyHunters have identified executives at two ransomware negotiation firms with unusually close ties to the group, including a U.S.-based executive suspected of helping run the now-defunct Shinywire victim extortion site. The site was active from about May 3, 2026 to October 16, listed nearly 100 alleged victims, and pressured organizations to negotiate before stolen data was published. Canadian cybersecurity executive Edward Dubrovsky has been arrested in the probe, while the U.S. executive and firm named by sources have not been charged.

For organizations hiring breach negotiators, the reported detail that some executives allegedly knew ShinyHunters victim details before victims did makes vendor controls and conflict checks a practical necessity, not just procurement paperwork. The trade-off is that negotiators may help manage communication with criminals, but close or opaque relationships can create legal and reputational risk; the limitation is that key records remain sealed and the U.S. firm and suspected executive have not been charged.