The Negotiators Were Working for the Hackers All Along
Monday, October 19, 2026 · 5-minute read
The hacking group ShinyHunters — which hacked the FBI's own recruitment website in September and has extorted over $70 million this year — is unraveling fast. Jordanian authorities detained suspected ringleader "Rey," a teenage hacker from Amman. Dutch police arrested a senior member, Pepijn van der Stap, using flash-bang grenades while he was actively logged into online accounts. The messages found on his Signal account then blew open a much bigger scandal.
↗ Krebs on SecurityEdward Dubrovsky, a 54-year-old Canadian cybersecurity executive who literally wrote a book on handling cyber extortion, was arrested by the FBI for allegedly working with ShinyHunters — the very type of group he advised clients against. Federal investigators say he knew ShinyHunters had stolen data from FBI servers and never told anyone. A separate unnamed U.S. consulting firm with over 1,000 employees is also under scrutiny, with at least one executive suspected of helping run the group's victim-shaming website, Shinywire.
↗ Krebs on SecurityCISA issued a detailed advisory warning that Chinese government-linked hackers are blending automated scanning tools with hands-on human hacking to steal sensitive data from government and private networks. Think of it as combining a robot that finds unlocked doors with a skilled burglar who walks through them. The advisory urges organizations to patch known vulnerabilities immediately and monitor networks for unusual access patterns.
↗ CISAIf you run a WordPress website and use the paid version of the Rank Math SEO plugin, pay close attention. Attackers managed to slip backdoor malware into official copies of Rank Math PRO downloaded between October 15 (8:02 PM UTC) and October 16 (7:12 AM UTC). Any site that installed those copies during that window should be treated as fully compromised. The nasty part: the malware can recreate itself whenever anyone visits the infected site, meaning even installing the clean replacement (version 3.0.124) won't remove hidden admin accounts, files, or scheduled tasks the malware may have already planted elsewhere on your server.
A supply chain attack called GhostAction has spread to 94 GitHub repositories. The attackers are now phishing open-source software developers with emails pointing to a fake site (my-github[.]com) and tricking them into downloading what looks like a font file — but is actually credential-stealing malware. Developers are a high-value target because their compromised accounts can be used to poison software that thousands of other people then install.
A maximum-severity flaw in the BlockStrap component used by Magento and Adobe Commerce online stores lets attackers run any PHP code they want on the server — no login required. In plain terms, a criminal could take complete control of an e-commerce store, steal customer payment data, or plant malware for shoppers. Security researchers are warning that working exploits are expected to appear very soon.
Status: Patch available — update your Magento or Adobe Commerce installation immediately. If you run an online store on either platform, treat this as urgent.
NGINX is the web server software quietly powering a huge chunk of the internet. F5 rushed out emergency patches for three critical flaws in NGINX that could let attackers run their own code on vulnerable servers — potentially taking over websites, apps, or the services behind them. These are out-of-band patches, meaning F5 didn't wait for a scheduled update cycle because the risk is that serious.
Status: Patches released — if your organization runs NGINX, apply these out-of-band updates now rather than waiting for your next maintenance window.
BeyondTrust makes software that IT teams use to remotely access and fix employees' computers. CISA issued an urgent alert urging organizations to patch a critical vulnerability in BeyondTrust Remote Support, warning that attackers are already exploiting it in the wild. If left unpatched, an attacker could use this flaw to piggyback on legitimate IT support sessions and gain deep access to corporate systems.
Status: Patch available — CISA has added this to its Known Exploited Vulnerabilities catalog, meaning federal agencies must patch immediately. Everyone else should treat this as high priority.
This isn't a new defense tool — it's a new threat worth knowing about. Security researchers at Flare have documented a thriving underground market where criminals sell everything needed to beat KYC identity checks: forged passports, deepfake videos of fake people, and even live human "verification assistants" who impersonate real customers on video calls in real time. These services let fraudsters open bank accounts, crypto wallets, and financial accounts under false identities at scale. Understanding that this market exists helps security and compliance teams design tougher checks that go beyond what these services can fake.
↗ BleepingComputer / FlareImagine your house is robbed. You call a negotiator to help get your belongings back — and it turns out the negotiator was quietly tipping off the burglar about what you own. That's the scenario playing out in one of the most explosive cybersecurity stories of the year, and it raises a deeply uncomfortable question: can organizations trust the people they hire to help them during a cyberattack?
The ShinyHunters hacking group has been on a rampage in 2026, stealing data from companies and government agencies and demanding ransoms. The group even hacked the FBI's own hiring website, stealing personnel files with home addresses, medical records, and Social Security numbers of federal employees. The audacity of that attack triggered an unusually fast and aggressive law enforcement response. Dutch police arrested senior member Pepijn van der Stap while he was actively logged in to his Signal account. That live access gave investigators a window into his private conversations. What they found was stunning: van der Stap had been in regular contact with ransomware negotiators — the professionals companies pay specifically to handle exactly these kinds of attacks. One of those contacts, Canadian executive Edward Dubrovsky, allegedly knew about the FBI breach before the FBI did and said nothing.
The implications here are serious for any organization that has ever hired outside help during a ransomware incident. The entire model of ransomware response relies on a trusted middleman who can speak to both sides. If those middlemen have financial or personal ties to the criminal groups, every conversation, every piece of shared evidence, and every negotiation strategy could be flowing straight back to the attackers. Separately, a prestigious U.S. consulting firm with more than 1,000 employees is now under scrutiny, with investigators believing at least one executive there actively helped run Shinywire — the group's website that pressured victims into paying up. That firm has not been named because no charges have been filed yet.
Watch for more arrests. Federal investigators appear to be working methodically through van der Stap's message history, and both the Canadian and the unnamed U.S. firm cases are still unfolding. For organizations, the lesson is to vet any third-party incident response or negotiation firm carefully — check for conflicts of interest, ask who they've worked with, and make sure any sensitive information shared during a breach response is treated as need-to-know only.