Feds Suspect a Ransom Negotiator Helped Run Hacker Extortion Site

Federal investigators chasing ShinyHunters, the hacking group that recently stole highly sensitive data from the FBI, have identified executives at two different ransomware negotiation firms who kept unusually close relations with the group, KrebsOnSecurity reports. Two sources close to the probe told the outlet that FBI investigators believe at least one executive at a U.S.-based consulting firm played an active role in operating the group's now-defunct victim extortion website.

Krebs is not naming the company or the suspected executive because no one there has been charged with a crime. The outlet describes the firm as prestigious, with more than 1,000 associates.

The extortion site, which Krebs identifies as shinywire.com, was active from about May 3, 2026 until October 16, the outlet reports. It carried entries for nearly 100 organizations hacked by ShinyHunters. Each entry urged the victim to engage with the group and discuss payment terms, posted samples of stolen files and promised to publish the files if the victim ignored the demands.

Hackers aligned with ShinyHunters have claimed credit for dozens of major breaches since 2019, when the group was run mainly by cybercriminals living in France, Krebs reports. The theft of the FBI's own data has pushed the bureau to move with uncommon speed to arrest, detain and question people who had any contact with ShinyHunters suspects. Reuters reported on October 3 that one suspect had been detained by Jordanian authorities and was cooperating with the FBI, according to Krebs.

Krebs notes that leading incident response firms, including Coveware and Unit 221B, have consistently warned victims against paying ShinyHunters. The reason, those firms say, is that data the group claims to have destroyed is often kept, resold or used to extort the victim's clients later.