Canadian cybersecurity executive arrested in federal extortion case

Details of the case align with the investigation into ShinyHunters’ attack on FBI IT systems.

Federal authorities arrested a Canadian cybersecurity executive Thursday in Pennsylvania on charges of conspiracy of extortion, according to federal court records posted Friday.

Edward Dubrovsky, 54, is a former chief operating officer and founder of CYPFER, a firm that helps organizations negotiate with ransomware operators. He is charged with conspiring to threaten the confidentiality of information in order to extort money, a violation of federal computer fraud law, and with conspiring to commit Hobbs Act extortion, which involves using threats to obstruct or affect interstate commerce to obtain money. Other details of the case remain sealed. 

While the FBI did not publicly announce Dubrovsky’s arrest, the case appears to align with actions taken in the wake of the ShinyHunters’ attack on the FBI’s IT systems, which exposed personal data about thousands of bureau employees. FBI Director Kash Patel said in a social media post that the bureau had arrested “another suspected co-conspirator” of the group, but did not name the suspect. The New York Times reported Friday that a Canadian man was arrested in Pennsylvania in connection with the attack.

When asked for further comment, the FBI pointed CyberScoop to Patel’s social media post. 

Dubrovsky’s LinkedIn page lists his role at CYPFER and an affiliation with CyberSteward, which LinkedIn describes as a Toronto-based firm that helps breach victims negotiate ransom payments. Last month, Dubrovsky released a book covering how to deal with ransomware negotiations. 

Neither Dubrovsky or CYPFER responded to requests for comment. 

The FBI breach has drawn widespread attention. The attack marks a sobering escalation by ShinyHunters, a notorious group that previously targeted major cloud platforms, healthcare organizations, universities, technology companies, retailers and education service providers. Previous victims of ShinyHunters this year include Instructure, Salesforce, Snowflake and McKesson. 

Brett Leatherman, the FBI’s assistant director for cyber, said a review found the breach resulted from a third-party platform, where a contractor had not installed a security patch issued for the system. Reuters reported that the contractor worked for Accenture.

Since the breach was disclosed, several suspects have been taken into custody. In September, Dutch authorities arrested a 24-year-old suspected of affiliation with ShinyHunters. Additionally, a teenager, which Reuters identified as Saif Al-din Khader, had been detained and was cooperating with investigators. 

Dubrovsky’s case docket states that the case has been moved to the Eastern District of Texas, where Dubrovsky will be detained until a detention hearing is scheduled. 

Government

• Major rules for federal contractors handling sensitive data are nearing the finish line

• FBI, French authorities seize deepfake CSAM-for-sale websites 

• Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacks

• Former NSA chief Nakasone says agency overhaul is ‘probably needed’

Technology

• The legal questions raised by agentic AI hacks

• As AI world debates security, NVIDIA releases open source tools for agents

• New bill would create federal investigative body for AI-driven hacks 

• CISA outlines improvement plan for CVE program

Threats

• PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem

• Citrix discloses third actively exploited NetScaler zero-day in less than a week

• AI policy circles targeted in China-linked phishing operation

• WaterISAC reckons with range of threats after summer of cyberattacks

Policy

• Wiretapping change sparks big privacy fight in the Golden State

• Here’s how experts think CISA should tell agencies to protect OT

• National cyber director: Government-industry collaboration vital to managing AI risks, competition with nations

• US is looking to weave AI into critical infrastructure for cybersecurity, national cyber director says