Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe
FBI arrested Canadian expert Edward Dubrovsky over alleged ShinyHunters extortion, including an FBI systems intrusion.
The FBI arrested Canadian ransomware-response specialist Edward Dubrovsky in Philadelphia, alleging he conspired with ShinyHunters, including in an intrusion into FBI systems. Prosecutors charged conspiracy to threaten the confidentiality of information in order to extort money and interference with commerce by threats; the case moved to the Eastern District of Texas. The FBI blamed a contractor’s failure to patch Oracle PeopleSoft, while the group claimed data on nearly all agents and applicants. Dubrovsky, linked to Toronto firm CyberSteward, is the third alleged member held in recent weeks, after arrests in the Netherlands and Jordan.
- FBI arrested Edward Dubrovsky in Philadelphia over alleged ShinyHunters extortion.
- Charges include conspiracy to extort and interference with commerce by threats.
- FBI blamed an unpatched Oracle PeopleSoft system maintained by a contractor.
- ShinyHunters claimed agent and applicant data from the FBI jobs site.
- Two other alleged members were arrested in the Netherlands and Jordan.
Full article502 words · extracted from securityweek.com · click to collapse
A Canada-based cybersecurity expert was arrested last week in the United States on suspicion of being involved in ShinyHunters attacks, including the recent hacking of FBI systems.
FBI director Kash Patel announced on Friday that agents had arrested another suspected ShinyHunters co-conspirator.
“This is the latest arrest this FBI has made in a matter of days involving this network, as we work non-stop to dismantle the group, pursue new leads and evidence, and act quickly,” Patel stated, adding, “We will continue to work closely with our partners to disrupt what’s left of the ShinyHunters group and their associates, no matter where they operate.”
The suspect has not officially been named, but The New York Times and cybersecurity blogger Brian Krebs reported that he is Edward Dubrovsky, a Canadian cybersecurity expert specializing in ransomware response.
The Royal Canadian Mounted Police confirmed for CBS News that it’s aware of the arrest of a Canadian in the United States in connection with ShinyHunters.
Dubrovsky was reportedly arrested by the FBI after traveling to Philadelphia for a conference. He is suspected of being involved in the recent ShinyHunters attack targeting the FBI.
Advertisement. Scroll to continue reading.
The extortion group claimed to have accessed the FBI’s jobs website and other systems, allegedly obtaining information on nearly all agents and job applicants. The hackers said they carried out the attack in response to a report the FBI published earlier in the year warning organizations about ShinyHunters activity.
The FBI blamed the intrusion on a contractor’s failure to patch vulnerable Oracle PeopleSoft software.
Dubrovsky appears to be affiliated with Toronto-based CyberSteward, which offers ransomware negotiation services. His LinkedIn profile lists him as an executive at a couple of North American cybersecurity companies in recent years. Dubrovsky is also the author of a book titled “Cyber Extortion: Strategic Response”.
Court records (which spell his name Dobrovsky) show the man was charged with conspiracy to threaten to impair the confidentiality of information with the intent to extort money, and interference with commerce by threats.
Records also show the case has since been moved to the Eastern District of Texas, where the FBI’s ShinyHunters probe is reportedly being run.
This is the third ShinyHunters suspect arrested in recent weeks. Authorities arrested one alleged key member in the Netherlands on September 15. Another alleged key member was reportedly arrested in Jordan on September 28 and is cooperating with the FBI.
In late September, ShinyHunters appeared defiant, saying that its operations and infrastructure had remained unaffected and urging victims to pay up. Statements addressed to the FBI and victims were later removed from the group’s Tor-based website, and the site no longer appears to be accessible at the time of writing.
Sources told Krebs that executives at other firms offering ransomware negotiation services could face charges in this case.
Related: Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison
Related: US Disrupts Chinese State-Sponsored Hacking Tools
Related: Fake Decryption Tools Masked $11M Markup in Ransomware Recovery Scheme