U.S. federal investigators pursuing the ShinyHunters hacking group have identified executives at ransomware negotiation firms who maintained unusually close relations with the extortion operation, according to KrebsOnSecurity.
ShinyHunters has claimed responsibility for dozens of major data breaches since 2019, when the group was primarily run by French cybercriminals. As original members were arrested, control passed to “Rey,” identified as a teenage hacker from Amman, Jordan. According to the FBI, ShinyHunters has extorted more than $70 million from victims this year.
In late September, ShinyHunters hacked the FBI recruitment website fbijobs.gov and threatened to publish stolen files including medical and psychological records, Social Security numbers, home addresses, and employee unit information. The breach prompted the FBI to move quickly in detaining and questioning people with communications to Rey and other suspects. Rey was detained by Jordanian authorities and reportedly cooperated with the FBI.
On September 15, Dutch authorities arrested convicted hacker Pepijn van der Stap, a suspected senior ShinyHunters member. According to sources close to the investigation, police accessed van der Stap’s Signal instant messaging account during his arrest, revealing communications with ransomware negotiators in Canada and the United States.
On October 9, the FBI arrested Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive, in connection with the investigation. Dubrovsky, who recently published a book on cyber extortion, was charged with threatening to disclose stolen data and interfering with interstate commerce through extortion. According to sources, van der Stap’s Signal messages showed Dubrovsky had frequent conversations with the Dutch hacker and knew ShinyHunters had stolen FBI data, but never informed the bureau prior to the group’s public threats.
FBI investigators believe at least one executive at a large U.S.-based consulting firm with over 1,000 associates played an active role in operating “shinywire.com,” the now-defunct ShinyHunters victim extortion website. The site was active from May 3 until October 16 and listed nearly 100 organizations hacked by ShinyHunters. According to sources, executives at these firms often knew details about new victims before the victims themselves had learned of breaches.
The Shinywire pages included stolen file samples and threatened publication if victims ignored ransom demands. Victims who refused to engage within seven days would have their data published on the ShinyHunters victim blog accessible via Tor.
Key facts
- ShinyHunters has extorted over $70 million this year according to FBI estimates
- The group hacked the FBI recruitment website fbijobs.gov in late September
- Edward Dubrovsky, a Canadian cybersecurity executive, was arrested October 9 in connection with the investigation
- Dutch authorities arrested ShinyHunters suspect Pepijn van der Stap on September 15
- Investigators believe a U.S. consulting firm executive helped operate the shinywire.com extortion website
- Rey, identified as a teenage hacker from Jordan, currently leads ShinyHunters after French founders were arrested