Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
KrebsOnSecurity investigation reveals U.S. investigators examining close ties between ransom negotiation firms and ShinyHunters; one executive allegedly helped operate extortion website
Key Takeaways
- U.S. federal investigators have identified executives at two ransomware negotiation firms with close ties to ShinyHunters.
- One U.S.-based executive is alleged to have helped ShinyHunters operate an extortion website pressuring victims into paying ransoms.
- The investigation stems from ShinyHunters' theft of sensitive data from the FBI.
- Details on specific executives, exact timelines, and victim counts are currently unverified.
- No patch is available; vigilance and contact verification are recommended.
Quick answers
- What happened?
- U.S. federal investigators pursuing the ShinyHunters hacking group have identified executives at two ransomware negotiation firms who maintained unusually close relations with the group. Sources indicate one U.S.-based executive helped ShinyHunters operate a website used to pressure victims into paying ransoms. The investigation follows ShinyHunters' theft of highly sensitive data from the FBI. Details regarding specific executives, exact timelines, and definitive victim counts remain unverified.
- What should defenders do?
- Organizations should verify the legitimacy of ransom negotiation contacts, monitor FBI and CISA advisories, and implement strict internal controls regarding ransom payments. Due diligence on third-party negotiation firms is recommended.
According to KrebsOnSecurity, U.S. federal investigators looking into the ShinyHunters hacking group have uncovered that executives at two different ransomware negotiation firms maintained close relationships with the extortion group. Sources close to the investigation state that one executive based in the United States went further, allegedly assisting ShinyHunters in operating a website designed to pressure victims into paying ransoms. This development comes as ShinyHunters is reported to have stolen highly sensitive data from the FBI. The nature of the alleged involvement suggests a potential breach of the integrity expected from ransom negotiation services. The investigation is ongoing, and the specific identities of the executives, the precise timeline of their actions, and the full extent of victim impact have not been independently verified. No patch is available for this situation; authorities recommend vigilance and verification of ransom negotiation contacts.
Security Details
Investigators suspect a ransomware negotiation firm executive helped ShinyHunters operate a website used to pressure victims into paying ransoms. The ShinyHunters group is reported to have exfiltrated sensitive data from the FBI. The close relations between negotiation firm executives and the threat actor raise concerns about the integrity of ransom negotiation services.
Mitigation
Organizations should verify the legitimacy of ransom negotiation contacts, monitor FBI and CISA advisories, and implement strict internal controls regarding ransom payments. Due diligence on third-party negotiation firms is recommended.
Sources
Krebs on Security
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
Oct 19, 2026 · 13:48
Original link
Related Security News
ConnectWise Disables Application Identities Following Microsoft 365 Tenant Compromise
ConnectWise has disabled seven application identities, including ConnectWise Cloud Backup, after unknown threat actors obtained unauthorized access and compromised Microsoft 365 tenants. The investigation into the incident remains ongoing.
