Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
Curated from Krebs on Security
This investigation highlights a critical blind spot in incident response: the third-party ecosystem. When organizations outsource ransomware negotiations, they inadvertently grant external actors access to sensitive operational details and communication channels. If a negotiator is compromised or colluding, they become a vector for data exfiltration and extortion, effectively undermining the very containment efforts they were hired to support. The ShinyHunters case illustrates that trust in external vendors is not a substitute for rigorous vetting and continuous monitoring. For practitioners, this means you must treat negotiation firms as high-risk extensions of your perimeter. Takeaway: Implement strict least-privilege access controls for any third party handling incident communications, and require real-time audit logs of all data shared during negotiations to detect anomalous behavior before it becomes a breach.
U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned.
— Krebs on Security