ShinyHunters arrest number three: a Canadian ransomware negotiator
FBI arrested Canadian negotiator Edward Dubrovsky on extortion charges in its ShinyHunters crackdown, the third recent detention.
U.S. authorities arrested Canadian Edward Dubrovsky, also recorded as Dobrovsky or Dobrosky, in Pennsylvania on October 8 on conspiracy and commerce-interference charges tied to extortion. Filings in the Eastern District of Pennsylvania were transferred toward the Eastern District of Texas, where the FBI's ShinyHunters investigation is focused, and the main complaint remains sealed. Public reporting links him to Canadian firms Cypfer and CyberSteward, which advertise ransomware negotiation. This is the third suspected ShinyHunters-related arrest after detentions in the Netherlands on September 15 and Jordan on September 28. The FBI says the group extorted more than $70 million this year and previously claimed FBI employee data via an unpatched contractor Oracle PeopleSoft system.
- Edward Dubrovsky was arrested October 8 in Pennsylvania on extortion-related charges.
- The sealed complaint was transferred toward the Eastern District of Texas.
- Two earlier suspected ShinyHunters arrests occurred in the Netherlands and Jordan.
- FBI says ShinyHunters extorted more than $70 million this year.
- Reporting ties him to negotiation firms CyberSteward and Cypfer.
Full article915 words · extracted from securityaffairs.com · click to collapse
A Canadian ransomware negotiator faces extortion charges in the FBI’s ShinyHunters crackdown. Here’s what is known, and what isn’t.
ShinyHunters is the focus of a global FBI investigation, and the crackdown has led to the October 8 arrest of a Canadian ransomware negotiator who now faces extortion charges. Reuters reported the arrest, citing court documents, prison records and a person familiar with the case. The group has also stolen information about FBI employees.
Court documents filed in the Eastern District of Pennsylvania, which includes Philadelphia, accuse the defendant of conspiring to threaten the confidentiality of information to extort money and of interfering with commerce.
“A Canadian ransomware negotiator was arrested Thursday and faces unspecified extortion charges, according to court documents, prison records and a person familiar with the matter, as the FBI cracks down on a hacking group that stole information about its employees.” Reuters states. “Edward Dubrovsky faces charges of conspiracy to “threaten to impair the confidentiality of information with intent to extort money” and “interference with commerce,” according to court documents, opens new tab filed with the Eastern District of Pennsylvania, which covers Philadelphia.”
Krebs on Security reports that the second charge involves threats. The main criminal complaint remains sealed, so the details of the defendant’s alleged role are not yet public.
The records spell the last name two ways, Dobrovsky or Dobrosky, and they don’t list an age, a profession or an employer. A person briefed on the matter told Reuters the defendant is Edward Dubrovsky, a Canadian cybersecurity executive. Reuters couldn’t even settle the spelling, which tells you how early this is.
“Federal court records show that on October 8, an Edward Dobrovsky (note the slight misspelling of the last name) was arrested in Pennsylvania on cyber extortion and conspiracy charges.” states the report. “Several of those documents — including the core complaint — are now sealed. But a handful of them were indexed at Courtlistener.com, including a summary of the complaint, which charges the defendant with “conspiracy to threaten to impair the confidentiality of information with the intent to extort money,” and “interference with commerce by threats.””
Federal prosecutors in Philadelphia didn’t return repeated messages about the discrepancies. Reuters also couldn’t reach Dubrovsky, his lawyers, or CyberSteward, the company named on his LinkedIn profile. According to Krebs, the available records showed no attorney yet.
“An online search reveals the Cyber Risk Summit was held at the Loews Philadelphia Hotel between Oct. 5 and Oct. 7. The conference had several sponsors, but according to the summit’s website its biggest sponsor was a Canadian security company called Cypfer.” states Krebs. “According to LinkedIn, one of Cypfer’s “ex-founders” was Edward Dubrovsky, who is now associated with another Canadian security firm and sponsor called CyberSteward. In a post to LinkedIn approximately one month ago, Dubrovsky said he had plans to attend the Cyber Risk Summit with the rest of the CyberSteward team.”
CyberSteward advertises itself as a specialist in threat actor engagement, cyber extortions, complex negotiations and settlement facilitation. On LinkedIn, Dubrovsky presents himself as an expert in negotiating ransom payments with cybercriminals. SecurityWeek notes he’s also the author of a book on responding to cyber extortion.
Politico and Krebs reported the arrest first. Krebs says he was in Philadelphia for a cyber insurance conference. Federal prison records show a man with his name detained at a federal detention center in the city.
ShinyHunters is the backdrop. Last month the group claimed it had stolen information on nearly every FBI employee, and it said it got into the bureau’s jobs website and other systems in response to an FBI report earlier this year warning about its activity. FBI blamed the intrusion on a contractor’s failure to patch vulnerable Oracle PeopleSoft software.
When Reuters asked about the arrest, the FBI pointed to a statement from Director Kash Patel and declined further comment.
— FBI Director Kash Patel (@FBIDirectorKash) October 9, 2026🚨 Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group – the group believed to be responsible for the recent https://t.co/RG0D4I5KFS incident, which occurred on a platform managed by a third-party vendor.
This is the latest arrest…
Patel described the arrest as the latest in a series of actions against ShinyHunters over just a few days. According to SecurityWeek, he said the FBI will continue working to disrupt the remaining network. This is the third suspected arrest linked to ShinyHunters in recent weeks, following one in the Netherlands on September 15 and another in Jordan on September 28.
The case has also moved to another court. A notice filed on October 9 transferred it to the Eastern District of Texas, where sources told Krebs on Security the FBI’s ShinyHunters investigation is focused.
However, authorities have not publicly explained what the defendant allegedly did. Reuters reports that the charges have not been specified, and the main complaint remains sealed. Krebs on Security also reports, citing sources, that executives at other ransomware negotiation firms could face charges. The FBI says ShinyHunters has extorted more than $70 million this year.
The latest arrest brings the number of suspected ShinyHunters members detained in recent weeks to three. On September 15, authorities arrested a suspected member in the Netherlands. A second alleged key member was reportedly arrested in Jordan on September 28 and is said to be cooperating with the FBI.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, ShinyHunters)