Threat reportThreat IntelligenceTL-2026-3891
ShinyHunters Extortion Site (Shinywire.com) Allegedly Operated by Ransom Negotiator Edward Dubrovsky; FBI Jobs Data Stolen
ShinyHunters Extortion Site (Shinywire.com) Allegedly (TL-2026-3891), also tracked as Shinywire, is a high-severity tracked intrusion set, first published 2026-10-19. It is attributed to ShinyHunters with medium confidence, affects U.S. Federal Bureau of Investigation fbijobs.gov careers site and, maps to 9 MITRE ATT&CK techniques (T1078.004, T1098.005, T1213), and is covered by 9 detection rules and 12 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 9MITRE ATT&CK
- Actors
- 1ShinyHunters
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-3891
- Threat ID
- TL-2026-3891
- Also known as
- Shinywire, Shinywire.com
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- ShinyHunters
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- government administration, education, health, technology, retail, telecoms, entertainment
- Target regions
- North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in ShinyHunters Extortion Site (Shinywire.com) Allegedly
Malware and tooling: Signal, Tor - S0183
How ShinyHunters Extortion Site (Shinywire.com) Allegedly works
Per KrebsOnSecurity (2026-10-19), the FBI arrested Canadian ransom negotiator Edward Dubrovsky (54) on 2026-10-09 on extortion-related charges, and prosecutors suspect negotiator insiders were tied to the ShinyHunters extortion site Shinywire.com (active 2026-05-03 to 2026-10-16, ~100 listed victims). ShinyHunters allegedly extorted over $70 million in 2026 and stole sensitive data from fbijobs.gov in late September 2026.
KrebsOnSecurity reported on 2026-10-19 that federal prosecutors suspect insiders in the ransomware-negotiation industry were involved in operating Shinywire, the extortion/leak website of the ShinyHunters cybercrime group. Shinywire was online from 2026-05-03 to 2026-10-16, listed roughly 100 ShinyHunters victims, published samples of stolen files and threatened full publication within 7 days. Prosecutors allege the site was run by an executive at a large U.S. consulting firm (1,000+ associates) who has not been charged or named; that executive and Canadian cybersecurity executive Edward Dubrovsky (54) appear in Signal chats recovered from Dutch hacker Pepijn van der Stap, who was arrested in the Netherlands on 2026-09-15. Per Krebs, these insiders often knew the details of new ShinyHunters victims before the victims themselves learned of the breach. Dubrovsky was arrested on 2026-10-09 in the Philadelphia area and charged with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion (Eastern District of Pennsylvania records cited by Reuters; the related Eastern District of Texas case is sealed). He allegedly knew ShinyHunters had stolen highly sensitive data from FBI servers and never informed the bureau. Cypfer, the Toronto firm Dubrovsky is associated with, stated on 2026-10-14 that it had no prior knowledge of the arrest. All allegations against Dubrovsky and the unnamed executive are unproven.
ShinyHunters allegedly extorted over $70 million in 2026. In late September 2026 (claim posted 2026-09-22) the group claimed to have stolen sensitive data on nearly all FBI agents from fbijobs.gov; apply.fbijobs.gov and the Special Agent Applicant Portal were taken offline and, per CyberDaily, defaced. Krebs reports the exposed data includes medical records, psychological files, SSNs, home addresses and employee unit/specialization data. Reuters matched at least nine sample records against credit-bureau and previously breached data but could not confirm they came from FBI systems. The group said the action responded to the FBI's 2026-05-15 IC3 PSA (I-051526-PSA), which described ShinyHunters' methods and advised victims not to pay or engage; that PSA was issued after the Canvas/Instructure breach (Instructure confirmed a ransom agreement on 2026-05-12). The FBI notes ShinyHunters harasses victims and their families with threatening calls and texts, makes false claims of compromising material, and in some cases swats.
Tradecraft documented elsewhere in the 2025-2026 ShinyHunters campaigns (Mandiant UNC6040, linked to UNC6661) starts with voice phishing: callers impersonate IT support, direct employees to credential/MFA-harvesting pages mimicking SSO portals, register attacker-controlled devices for MFA, and mass-export data from SaaS platforms such as Salesforce and Okta-fronted applications. Krebs also reports an Intuitive Surgical breach in March 2026 via phishing. The case sits alongside other insider-in-the-response-chain prosecutions Krebs cites (MonsterCloud CEO Zohar Pinhasi, charged 2026-10-07; negotiator Angelo Martino, sentenced to 70 months for aiding BlackCat/ALPHV). The source contains no CVEs and no hash or IP IOCs; BeaconBeagle returned no matches for shinywire.com. Severity is analyst-assigned.
MITRE ATT&CK techniques used in TL-2026-3891
Initial Access
T1078.004 Valid Accounts: Cloud Accounts; T1566 Phishing; T1566.004 Spearphishing Voice
Persistence
T1098.005 Account Manipulation: Device Registration
Collection
T1213 Data from Information Repositories
Impact
T1491.002 Defacement: External Defacement; T1657 Financial Theft
Resource Development
T1583.001 Acquire Infrastructure: Domains
Defense Evasion
Affected products and versions in ShinyHunters Extortion Site (Shinywire.com) Allegedly
- U.S. Federal Bureau of Investigation — fbijobs.gov careers site and Special Agent Applicant Portal
Vulnerable versions: Not specified in sources - Instructure — Canvas learning management system
Vulnerable versions: Not specified in sources - PowerSchool — PowerSchool student information system (December 2024 extortion)
Vulnerable versions: Not specified in sources
Remediation for ShinyHunters Extortion Site (Shinywire.com) Allegedly
Immediate actions
- Do not engage with or pay actors claiming to hold your data, per the FBI IC3 PSA I-051526-PSA of 2026-05-15; report to FBI/IC3
- Vet ransom negotiators and incident-response intermediaries: contractually require conflict-of-interest and confidentiality terms and limit what victim data they hold
- Brief help desks and employees on voice-phishing impersonation of IT support; require call-back verification before any credential, MFA or device-registration change
- Alert on new MFA device registrations and unusual bulk exports from SaaS platforms such as Salesforce and Okta-fronted apps
Workarounds
- Treat data from affected portals (for example fbijobs.gov applicants) as exposed; monitor for identity theft, spearphishing and doxxing
Longer-term hardening
- Move privileged and SSO accounts to phishing-resistant MFA (FIDO2/passkeys)
- Restrict SaaS API/bulk export permissions and apply conditional access by device and network
- Prepare an extortion/harassment response plan covering executives and family members, including swatting awareness
- Minimize retention of sensitive HR, medical and applicant data in internet-facing portals
Timeline of ShinyHunters Extortion Site (Shinywire.com) Allegedly
- PowerSchool extortion begins (62M students, 9.5M teachers); $2.85M ransom paid with CyberSteward assisting negotiations; ShinyHunters affiliate Matthew Lane later sentenced to 4 years (November 2025), per Krebs.
- Intuitive Surgical breached via phishing of an employee, per Krebs (March 2026; exact day not stated).
- Shinywire extortion site goes live, listing ShinyHunters victims, posting sample files and threatening publication within 7 days.
- Instructure confirms a ransom agreement with ShinyHunters following the Canvas breach.
- FBI IC3 issues PSA I-051526-PSA describing ShinyHunters' methods (harassment, swatting) and advising victims not to engage or pay.
- Dutch hacker Pepijn van der Stap arrested in the Netherlands; his Signal messages show frequent contact with Dubrovsky and a U.S. consulting-firm executive.
- ShinyHunters claims theft of data on nearly all FBI agents from fbijobs.gov; apply.fbijobs.gov and the Special Agent Applicant Portal go offline.
- Teenage ShinyHunters administrator known as Rey, from Amman, Jordan, detained by Jordanian authorities per Krebs.
- MonsterCloud CEO Zohar Pinhasi charged with wire fraud and conspiracy for secretly paying hackers while billing customers for remediation.
- Edward Dubrovsky (54) arrested in the Philadelphia area on charges of threatening to disclose stolen data and interfering with interstate commerce through extortion.
- Cypfer states it had no prior knowledge of Dubrovsky's arrest.
- Shinywire extortion site observed offline after running since 2026-05-03.
- KrebsOnSecurity publishes report linking suspected negotiator insiders to the Shinywire site.
Sources cited for ShinyHunters Extortion Site (Shinywire.com) Allegedly
- Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
- FBI IC3 PSA I-051526-PSA: ShinyHunters Cyber Criminal Group Attacks Learning Management System
- PSA: ShinyHunters Cyber Criminal Group Attacks Learning Management System (PDF copy)
- ShinyHunters hackers claim FBI breach, theft of employee data
- ShinyHunters hacks FBI, challenges agency over unfounded allegations
- Canadian ransomware negotiator arrested on federal charges amid FBI hacking probe (Reuters via FOX)
- Bitdefender: FBI warns of ShinyHunters after Canvas breach
- ShinyHunters / UNC6040 Voice-Phishing Campaign
- Okta, Salesforce and Google: ShinyHunters claim to be behind SSO-account data theft attacks
Detection coverage for TL-2026-3891
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3891 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.