As reported by Krebs on Security, U.S. federal investigators have uncovered evidence that executives at two ransomware negotiation firms maintained unusually close relationships with the ShinyHunters extortion group — with one U.S.-based executive allegedly helping operate the very leak site used to pressure victims into paying. This is not a minor scandal. It is a structural integrity failure in the ransomware incident response ecosystem that every CISO and breach counsel should be examining immediately.

Ransomware Alert: federal investigators have uncovered evidence that executives at two ransomware negotiation firms maintained unusually close relationships with the ShinyHunters extortion group — with one U.S.-based executive allegedly helping operate the very leak site used to pressure victims into paying.

The Core Problem: Aligned Incentives, Broken Trust

The ransomware negotiation industry operates on a simple premise: victims pay negotiators to act as neutral intermediaries who secure the best outcome — ideally data recovery at the lowest price, or at least minimized public exposure. That model depends entirely on the negotiator being a genuine advocate for the victim, not a silent partner of the threat actor.

What the Krebs investigation suggests is that at least two individuals positioned as victim advocates may have been simultaneously embedded in the extortion apparatus. If a negotiator is on both sides of the table — calming the victim while feeding intelligence to the attacker, or worse, operating the pressure mechanism — the entire negotiation is a rigged game. The victim isn't negotiating; they're being managed.

This isn't a conflict of interest. It's a controlled demolition disguised as a rescue operation.

Why This Matters Beyond ShinyHunters

ShinyHunters has extorted over $70 million this year alone, according to the FBI, and recently compromised the FBI's own recruitment portal — stealing medical records, psychological evaluations, SSNs, and unit assignments of FBI personnel. The group's trajectory from a France-based criminal collective to a Jordanian teenager's operation to an alleged multi-national network involving professional intermediaries tells us something important: extortion economics are professionalizing, and the services layer around threat actors is growing.

When negotiation firms become infrastructure for the threat actors they're supposed to be counterbalancing, we have to ask harder questions about the entire ransomware response supply chain:

Why This Matters Beyond ShinyHunters
Due diligence gaps: How are ransomware negotiation firms vetted? Is there any licensing, certification, or regulatory oversight that would catch double-agents?
Data exposure risk: Negotiators receive privileged information about victim networks, backup status, insurance limits, and executive communications. If that negotiator is also working for the attacker, that data is compromised from the first phone call.
Attorney-client privilege erosion: Many firms route negotiations through outside counsel to preserve privilege. If the intermediary is compromised, privilege claims may be undermined and litigation exposure increases.

The Van der Stap Signal Capture

The reported detail that Dutch authorities arrested ShinyHunters suspect Pepijn van der Stap while he was actively using Signal — allowing them to read recent communications with ransomware negotiators in Canada and the U.S. — highlights how end-to-end encryption offers no protection when the endpoint itself is seized. This is also a reminder that law enforcement is increasingly capable of mapping the entire services layer around threat actors through a single arrest.

What You Should Do

Shield53 Recommendations

  • Audit your incident response retainers. Review any existing or planned engagement with ransomware negotiation or IR firms. Request references, conflict-of-interest disclosures, and ask directly whether the firm or its principals have been contacted by law enforcement regarding any threat actor group.
  • Compartmentalize information. Never share full network architecture, backup locations, or insurance policy limits with a negotiator upfront. Provide only what is necessary to facilitate the engagement. If they push back, that's a red flag.
  • Involve legal counsel directly. Ensure outside counsel — not the negotiator — controls information flow and decision-making. The negotiator should be a tool under counsel's direction, not the lead actor.
  • Demand transparency on payment routing. If a ransom payment is made, the chain of custody for funds should be documented and reviewed. Negotiators who resist transparent fund handling warrant scrutiny.
  • Pre-qualify multiple firms. Don't wait for a crisis to select a negotiator. Interview several, check for law enforcement relationships, and maintain a vetted short list. Having alternatives reduces leverage any single firm holds over you.
  • Report suspicious behavior. If a negotiator pressures you toward payment with unusual urgency, discourages law enforcement involvement, or seems to know victim-specific details they shouldn't have, document and report it to the FBI or your national CERT.
The ransomware response industry has operated in a gray regulatory zone for years. This investigation may be the catalyst that forces it into the light. Organizations that rely on these services should act as though the trust model is already broken — and design their incident response accordingly.