SecOraLens
CriticalRansomware

FBI Arrests Executive at Ransomware Negotiation Firm

Krebs on Security·Source published ·1 min read

What happened?

Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested an executive at a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity. The New York Times reported today that the FBI has arrested a Canadian man in Pennsylvania on suspicion of assisting ShinyHunters. The Times story did not identify the man, nor did a statement on Twitter/X about the arrest from FBI Director Kash Patel.

Key details

  • FBI arrested a Canadian executive at a ransomware negotiation firm during a cyber insurance conference in Pennsylvania.
  • The suspect's company specialized in ransomware negotiations with cybercrime groups, and he authored a book on cyber extortion response.
  • Court records show the defendant charged with conspiracy to threaten to impair confidentiality to extort money and interference with commerce by threats.
  • The FBI's ShinyHunters investigation has been centralized at a Texas field office, and the case was moved to the Eastern District of Texas.
  • Dutch police arrested Pepijn van der Stap last month in connection with the ShinyHunters investigation, and the FBI seized devices from that arrest.
  • Another ShinyHunters member known as 'Rey,' identified as teenager Saif Al-din Khader, was detained and is cooperating with FBI investigators.

Affected

  • Cypfer, a Canadian security company and major sponsor of the Cyber Risk Summit.
  • CyberSteward, another Canadian security firm associated with the arrested executive.

What to look for

  • ShinyHunters uses phishing and stolen credentials to access corporate SaaS accounts and exfiltrate data.
  • The group threatens to publish stolen data unless ransom demands are paid.

Summarised by SecOraLens from Krebs on Security. Always read the original source before acting. How SecOraLens verifies advisories.

Back to all advisories