# ShinyHunters Extortion Site (Shinywire.com) Allegedly Operated by Ransom Negotiator Edward Dubrovsky; FBI Jobs Data Stolen

> Per KrebsOnSecurity (2026-10-19), the FBI arrested Canadian ransom negotiator Edward Dubrovsky (54) on 2026-10-09 on extortion-related charges, and prosecutors suspect negotiator insiders were tied to the ShinyHunters extortion site Shinywire.com (active 2026-05-03 to 2026-10-16, ~100 listed victims). ShinyHunters allegedly extorted over $70 million in 2026 and stole sensitive data from fbijobs.gov in late September 2026.

- **Published:** 2026-10-19T14:19:01Z
- **Last reviewed:** 2026-10-19T14:19:01Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3891
- **ID:** TL-2026-3891
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** ShinyHunters
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

KrebsOnSecurity reported on 2026-10-19 that federal prosecutors suspect insiders in the ransomware-negotiation industry were involved in operating Shinywire, the extortion/leak website of the ShinyHunters cybercrime group. Shinywire was online from 2026-05-03 to 2026-10-16, listed roughly 100 ShinyHunters victims, published samples of stolen files and threatened full publication within 7 days. Prosecutors allege the site was run by an executive at a large U.S. consulting firm (1,000+ associates) who has not been charged or named; that executive and Canadian cybersecurity executive Edward Dubrovsky (54) appear in Signal chats recovered from Dutch hacker Pepijn van der Stap, who was arrested in the Netherlands on 2026-09-15. Per Krebs, these insiders often knew the details of new ShinyHunters victims before the victims themselves learned of the breach. Dubrovsky was arrested on 2026-10-09 in the Philadelphia area and charged with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion (Eastern District of Pennsylvania records cited by Reuters; the related Eastern District of Texas case is sealed). He allegedly knew ShinyHunters had stolen highly sensitive data from FBI servers and never informed the bureau. Cypfer, the Toronto firm Dubrovsky is associated with, stated on 2026-10-14 that it had no prior knowledge of the arrest. All allegations against Dubrovsky and the unnamed executive are unproven.

ShinyHunters allegedly extorted over $70 million in 2026. In late September 2026 (claim posted 2026-09-22) the group claimed to have stolen sensitive data on nearly all FBI agents from fbijobs.gov; apply.fbijobs.gov and the Special Agent Applicant Portal were taken offline and, per CyberDaily, defaced. Krebs reports the exposed data includes medical records, psychological files, SSNs, home addresses and employee unit/specialization data. Reuters matched at least nine sample records against credit-bureau and previously breached data but could not confirm they came from FBI systems. The group said the action responded to the FBI's 2026-05-15 IC3 PSA (I-051526-PSA), which described ShinyHunters' methods and advised victims not to pay or engage; that PSA was issued after the Canvas/Instructure breach (Instructure confirmed a ransom agreement on 2026-05-12). The FBI notes ShinyHunters harasses victims and their families with threatening calls and texts, makes false claims of compromising material, and in some cases swats.

Tradecraft documented elsewhere in the 2025-2026 ShinyHunters campaigns (Mandiant UNC6040, linked to UNC6661) starts with voice phishing: callers impersonate IT support, direct employees to credential/MFA-harvesting pages mimicking SSO portals, register attacker-controlled devices for MFA, and mass-export data from SaaS platforms such as Salesforce and Okta-fronted applications. Krebs also reports an Intuitive Surgical breach in March 2026 via phishing. The case sits alongside other insider-in-the-response-chain prosecutions Krebs cites (MonsterCloud CEO Zohar Pinhasi, charged 2026-10-07; negotiator Angelo Martino, sentenced to 70 months for aiding BlackCat/ALPHV). The source contains no CVEs and no hash or IP IOCs; BeaconBeagle returned no matches for shinywire.com. Severity is analyst-assigned.

## MITRE ATT&CK

- T1566 Phishing
- T1566.004 Spearphishing Voice
- T1078.004 Valid Accounts: Cloud Accounts
- T1684.001 Impersonation
- T1098.005 Account Manipulation: Device Registration
- T1213 Data from Information Repositories
- T1583.001 Acquire Infrastructure: Domains
- T1491.002 Defacement: External Defacement
- T1657 Financial Theft

## Sources

- [Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site](https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/)
- [FBI IC3 PSA I-051526-PSA: ShinyHunters Cyber Criminal Group Attacks Learning Management System](https://ic3.gov/PSA/2026/PSA260515)
- [PSA: ShinyHunters Cyber Criminal Group Attacks Learning Management System (PDF copy)](https://www.law.berkeley.edu/wp-content/uploads/2026/06/PSA-ShinyHunters-Cyber-Criminal-Group-Attacks-Learning-Management-System_5.15.2026.pdf)
- [ShinyHunters hackers claim FBI breach, theft of employee data](https://www.staradvertiser.com/2026/09/22/breaking-news/shinyhunters-hackers-claim-fbi-breach-theft-of-employee-data/)
- [ShinyHunters hacks FBI, challenges agency over unfounded allegations](https://www.cyberdaily.au/security/14218-shinyhunters-hacks-fbi-challenges-agency-over-unfounded-allegations)
- [Canadian ransomware negotiator arrested on federal charges amid FBI hacking probe (Reuters via FOX)](https://www.fox5dc.com/news/canadian-ransomware-negotiator-arrested-federal-charges-amid-fbi-hacking-probe)
- [Bitdefender: FBI warns of ShinyHunters after Canvas breach](https://www.bitdefender.com/en-au/blog/hotforsecurity/fbi-shinyhunters-canvas-breach)
- [ShinyHunters / UNC6040 Voice-Phishing Campaign](https://openefa.com/security-advisories/shinyhunters-vishing-campaign.html)
- [Okta, Salesforce and Google: ShinyHunters claim to be behind SSO-account data theft attacks](https://blog.rankiteo.com/oktsalgoo1769222214-okta-salesforce-google-cyber-attack-january-2026/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3891