Breaking, exclusive: Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom.

From the story:

"KrebsOnSecurity has learned from two sources close to the ShinyHunters probe that FBI investigators believe at least one executive at a U.S.-based consulting firm played an active role in operating the now-defunct ShinyHunters victim extortion website “shinywire[.]com.” KrebsOnSecurity is not naming the U.S. company or the suspected executive(s) for now because they have not yet been charged with a crime, but it is a prestigious firm with more than 1,000 associates."

https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/

#shinyhunters #cybercrime #ransomware #fbi #shinywire

Six consuming tags. One Safari trick: <select>.

Bypass <noframes>, <xmp>, <noembed>, <style>, <title> and <noscript>. We've added all six vectors to our XSS cheat sheet:

https://portswigger.net/web-security/cross-site-scripting/cheat-sheet#byass-noscript-consume-using-select

I was investigating a big ransomware incident recently and somebody at the victim org told me they were negotiating payment with a vendor with their insurance and the NCA (national crime agency) in the room.

And it's just like.. considered normal. It fuckin' ain't, all this stuff needs to stop.

The FBI say they suspect a ransomware negotiator at a cyber firm - no, not one of the prior arrested cyber vendor people - ran ShinyHunters extortion site.

I've been saying this for years - the cybersecurity industry has many people who their hands directly in the pie.

The status quo sucks and governments really need to legislate around cyber ransom and extortion payments. Lots of cybersecurity things at vendors have become normalised which are not normal.

https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/

Pass the video

PASS THE BONG

Plex2Shell chain exploited in the wild for cryptomining against Plex media servers: https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html

• CVE-2026-96652 (5.3 med) Plex Media Server SSRF
• CVE-2026-96654 (6.9 med) Plex Media Server URL injection
• CVE-2026-96655 (5.3 med) Plex Media Server arbitrary-host SSRF
• CVE-2026-96656 (8.6 high) Plex Media Server arbitrary file write

#threatintel #plex #IOC #eitw

@GossiTheDog JENSEN HUANG THEN SAYS HAVE YOU EVER REALLY LOOKED AT YOUR HANDS AND ASKS IF ANYONE HAS ANY JAFFA CAKES