Edward Dubrovsky, a prominent ransomware negotiator, was charged in Pennsylvania with extortion conspiracy.
Edward Dubrovsky, 54, a Canada-based cybersecurity executive and ransomware negotiator, was arrested and charged in Pennsylvania with conspiracy to threaten to impair the confidentiality of information in order to extort money, under 18 U.S.C. 1030(a)(7)(B). He was an executive at incident-response firm Cypfer from 2022 through 2025, sits on the FileFlex advisory board, and has worked with advisory firm CyberSteward. The complaint remains sealed. FBI Director Kash Patel said the bureau arrested a suspected ShinyHunters co-conspirator linked to the FBIjobs.gov incident, and reporting suggests Dubrovsky may be that person, though Patel did not name him.
Charged in Pennsylvania under CFAA 1030(a)(7)(B) for extortion conspiracy.
Former Cypfer executive, FileFlex adviser, and recent CyberSteward associate.
The criminal complaint remains sealed, with no named victim incident.
Possible ShinyHunters link to FBIjobs.gov is suggested but unconfirmed.
Indicators of compromiseauto-extracted · verify before use · export allAll →
Type
Indicator
Context
md5
077dd53831947c3c9afd26b84b841700
guilty-blackcat-scheme#recipe=similar-items&sourcecontentid=077dd53831947c3c9afd26b84b841700) Ransomware Negotiator Pleads Guilty to BlackCat Scheme by
md5
9b9370f4eeacf2314c1036a0e73d3e68
e-ai-security-failures#recipe=similar-items&sourcecontentid=9b9370f4eeacf2314c1036a0e73d3e68) Is It Fair to Blame 'Rogue' AI for Security Failures? by
md5
ac80fc79ca813cc834a33fe37c78ce7a
veal-about-hidden-risk#recipe=similar-items&sourcecontentid=ac80fc79ca813cc834a33fe37c78ce7a) Inside the Data on Insider Threats: What 1,000 Real Cases
md5
cc0dcc6386a9386cc9b7cd4cb0f4b1a1
orth-korean-it-workers#recipe=similar-items&sourcecontentid=cc0dcc6386a9386cc9b7cd4cb0f4b1a1) Red Flags That Expose Fake North Korean IT Workers by Ale
Full article1,562 words · extracted from darkreading.com · click to collapse
US authorities last week charged a ransomware negotiator over alleged extortion activity — the latest example of cybersecurity professionals being implicated in the very activity they're supposed to defend against.
Edward Dubrovsky, 54, was charged for conspiracy to threaten to impair the confidentiality of information with the intent to extort money, under 18 U.S.C. § 1030(a)(7)(B), a federal provision of the Computer Fraud and Abuse Act (CFAA).
While the exact context of the charge remains unclear, as the main complaint is still sealed, what is particularly notable about this case is Dubrovsky's prominence within the security community as both an executive and an established ransomware negotiator. Prior to these charges, he regularly shared his expertise with various publications, including Dark Reading. He also recently self-published a strategic guidebook discussing best practices for responding to cyber-extortion attempts.
Based in Canada, Dubrovsky is associated with a number of cybersecurity firms. He previously was an executive at Cypfer, an incident response firm, from 2022 until the end of 2025, and is a member of the advisory board at FileFlex, a zero-trust product vendor. He also recently attended a cybersecurity conference in Philadelphia with a firm he said he currently works with, cybersecurity advisory firm CyberSteward.
Dark Reading reached out to Cypfer, CyberSteward, and FileFlex parent company Qnext for comment, but none responded by press time.
Possible ShinyHunters Connection
None of the publicly available documents involving Dubrovsky tie his arrest to a specific incident. However, FBI Director Kash Patel said in a post to X Friday that the bureau "arrested another suspected co-conspirator of the ShinyHunters group — the group believed to be responsible for the recent FBIjobs.gov incident, which occurred on a platform managed by a third-party vendor."
L o a d i n g...
While Patel did not identify the suspect, several factors suggest Dubrovsky may be the individual referenced in the post. A Philadelphia judge sent Dubrovsky's case to Texas, where a source told KrebsOnSecurity recent ShinyHunters investigations are centralized. Furthermore, The New York Times on Friday reported that the FBI arrested a Canadian man in Pennsylvania suspected of working with ShinyHunters.
ShinyHunters is a loose collective of threat actors known for data extortion attacks. The group previously was behind a number of highly visible threat campaigns involving compromised Salesforce instances and attacks on higher education institutions.
But perhaps most notably, ShinyHunters last month hacked a third-party jobs site used by the FBI. The group further claimed they stole data belonging to nearly every FBI employee and job applicant. In response, the FBI has aggressively pursued ShinyHunters, making a number of arrests in the process.
Other Legal Issues in the Ransomware Negotiation Industry
Dubrovsky is not the first ransomware negotiator charged in connection with his work. Last week, Zohar Pinhasi was arraigned by the US Attorney's Office for the Eastern District of New York on wire fraud charges for allegedly defrauding clients of his ransomware remediation company, MonsterCloud. Pinhasi was accused of promising clients that he could decrypt ransomware without paying criminals, only to then pay criminals himself and charge the end customer a substantial markup.
In another case, a ransomware negotiator, Angelo Martino, was convicted for sharing details with the BlackCat ransomware group in exchange for payment.
Jeff Wichman, Semperis senior director of breach preparedness and response, tells Dark Reading these incidents may impact the incident response industry to some degree going forward.
"I think these incidents are likely to put additional pressure on ransomware negotiation firms to strengthen their background check processes," he says. "These firms will likely also face greater scrutiny from the insurance industry, including the insurers that back ransomware negotiation firms."
Court records indicate Dubrovsky was represented by the Federal Defenders office during his initial appearance. Dark Reading could not reach Dubrovsky for comment.
Alex is an award-winning writer, journalist, and podcast host based in Boston. After cutting his teeth writing for independent gaming publications as a teenager, he graduated from Emerson College in 2016 with a Bachelor of Science in journalism. He has previously been published on VentureFizz, Search Security, Nintendo World Report, and elsewhere.
At Dark Reading, he covers a variety of cybersecurity topics, including the cybercrime ecosystem, open source security, and the intersection between AI and threat actors. In his spare time, Alex hosts the weekly Nintendo podcast, "Talk Nintendo Podcast," and works on personal writing projects, including two previously self-published science fiction novels.
He has received numerous awards, including TechTarget's Writer of the Year in 2022 as well as more than 10 Azbee awards for his reporting between 2022 and today.
Want more Dark Reading stories in your Google search results?
Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
Informa TechTarget|
