Argues that the metrics negotiators are judged on — getting demands reduced and ensuring data deletion — are inherently easier to achieve with a back channel to the attacker, and trivially easy if the negotiator IS the attacker. The 'rapport' framing that the industry has used for years was papering over a structural problem nobody wanted to examine.
Reports that feds suspect a ransom negotiator hired by victim companies was simultaneously helping operate the ShinyHunters extortion site. Frames this as the same person being on both sides of a wire transfer during the Snowflake-era extortion campaigns, with indictment details expected to emerge in coming weeks.
Surfaced the Krebs reporting on Hacker News, where it drew 173 points and 71 comments — signaling that the security community views the allegation as a significant development in understanding how ShinyHunters operated across the 2024 Snowflake breaches and subsequent campaigns.
Krebs on Security reports that federal investigators suspect a ransom negotiator — someone companies paid to talk down ShinyHunters during extortion incidents — was also helping run the extortion site on the other end of the line. The group, ShinyHunters, is the same crew tied to the Snowflake customer breaches of 2024 and a long list of data-theft extortion campaigns that followed.
The mechanics, if the suspicion holds, are straightforward and ugly. A victim gets breached. The victim hires an incident response firm. The IR firm brings in a negotiator who specializes in talking to this particular threat actor. The negotiator opens a channel on the extortion site, haggles, and in some cases gets the price down. The victim pays, the data allegedly comes down, everyone writes a post-mortem that praises the negotiator's "relationships" with the threat group. The uncomfortable implication of the federal theory is that the relationship was more direct than anyone disclosed.
This isn't a theoretical conflict of interest — it's the same person on both sides of a wire transfer, if the feds are right. The specifics of the indictment, the identity of the negotiator, and the firms involved will emerge over the coming weeks. What's already clear is that the ransomware economy has matured to the point where the service providers around it are a target-rich environment for exactly this kind of fraud.
The ransomware response industry has always had a structural problem that nobody wanted to look at too hard. A negotiator's value is measured in two things: how much they can shave off the demand, and how reliably the data actually gets deleted after payment. Both of those metrics are easier to hit if you have a back channel to the attacker. Both of them are trivially easy to hit if you *are* the attacker.
For years, the polite framing was that the best negotiators had developed "rapport" with specific threat groups — they knew the personalities, the dialect, the preferred payment rails. Clients paid premium rates for that rapport. In retrospect, that was always the question nobody asked out loud: at what point does rapport become collusion, and how would you tell from the outside?
The honest answer is that you can't tell from the outside, and the industry has no mechanism to make you able to tell. Incident response firms are not regulated the way financial advisors or lawyers are. There's no fiduciary duty on paper. There's no bar association that can disbar a negotiator caught running the other side. The engagement letters are confidential, the ransom amounts are confidential, the negotiations themselves are confidential, and the "proof of deletion" is a screenshot the attacker sends over a Tor chat. The entire supply chain of trust runs on the assumption that the people in the middle are not also at the ends.
ShinyHunters is a particularly instructive case because of how modular the group has become. They've run the leak site, they've resold stolen credentials, they've brokered access, and now — allegedly — they've been collecting fees from the victim side too. That's not a ransomware gang anymore; that's a vertically integrated extortion business with a captive IR arm. Compare it to the Conti leaks of 2022, which showed a flat org chart with coders, negotiators, and HR all on the same payroll. The shift here is that the negotiators were on *somebody else's* payroll, invoicing the victim through a legitimate-looking US firm, while taking a second cut from the group they were supposedly negotiating against.
The community reaction has been predictably bimodal. One camp — mostly people who have never had to make a payment decision at 2am with lawyers and insurance on the line — treats this as proof that nobody should ever pay. The other camp, which includes most practicing CISOs, treats it as a procurement problem: how do you source a negotiator who isn't compromised, when the market for "negotiators who have talked to this specific group before" is by definition small and opaque?
If you have a ransomware response retainer, pull the contract today and look for three things. First, does it require the negotiator to disclose prior or ongoing commercial relationships with the threat actor? Most don't, because the industry would rather not answer the question. Second, is there a clawback clause if the firm is later shown to have had an interest on the other side? Most don't have this either. Third, is the firm indemnified against this exact scenario, and if so by whom?
Treat your IR firm like you'd treat an auditor: assume the engagement letter is the only thing that will protect you when something goes wrong, and write it accordingly. If you're on a cyber insurance policy that mandates a specific panel of negotiators, ask your broker what diligence the insurer did on panel firms, and get the answer in writing. "They've been on the panel for five years" is not diligence; it's inertia.
For the technical team, the implication is more upstream. The fewer ransom negotiations you have to run, the less exposure you have to this entire category of fraud. That means the boring stuff: offline backups you've actually tested restoring from, segmentation that limits blast radius, identity hygiene that prevents the initial foothold, and detection on the data-exfil stage specifically — because once the data is out, you're in the negotiator's market whether you like it or not. Snowflake customers in 2024 learned this the expensive way: the breaches that fed ShinyHunters' pipeline were almost entirely accounts without MFA, scraped from infostealer logs on employee machines. The cheapest ransom negotiation is the one that never starts.
Expect two things in the next six months. One, at least one more negotiator or IR firm will get named in a related indictment — the economics of this scheme almost certainly mean more than one person figured out the arbitrage. Two, cyber insurers will quietly rewrite their panel requirements to include some version of a conflict-of-interest attestation, because their reinsurers will demand it. What probably *won't* happen is federal licensing of ransomware negotiators, even though this incident is the strongest argument for it yet. The industry has survived this long on opacity, and opacity is a hard habit to legislate away.
> In late September, ShinyHunters hacked the FBI recruitment website fbijobs.govThe OPM breach was 11 years ago and apparently the incompetence still reigns.
What kind of incentive structure do most ransomware negotiation firms use that would actually cause them to benefit from coordination with the ransomware groups, as happened in this case? Do ransomware negotiators get paid more if they negotiate a lower price?
Wait so people take "Ransomware Negotiation Firms" as a legitimate business? Isn't it incredibly plainly in site that they are all in on it? Seriously WTF why have they been allowed to exist and operate when they are de facto collaborators?
Oldest trick in the book. Organise the crime, then go to the victim with the solution.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
> Dutch police reportedly used flash-bang grenades in an effort to stun and apprehend Van der Stap as he was logged in to various online accounts.Holy moly, this is the first time I hear about this tactic. I remember more benign distraction tactics used previously with Ross Ulbricht and the other