FBI Arrests Canadian Ransomware Negotiator in ShinyHunters Probe; Cybersecurity Community Stunned

The FBI has arrested a Canadian cybersecurity executive known for negotiating with ransomware attackers, charging him as a suspected co-conspirator in the ShinyHunters hacking ring that recently stole sensitive data from the FBI’s own systems.

FBI Director Kash Patel confirmed the arrest Friday, calling it “the latest arrest this FBI has made in a matter of days involving this network.” In a social media post, Patel added: “We will continue to work closely with our partners to disrupt what’s left of the ShinyHunters group and their associates, no matter where they operate.”

Court documents from the U.S. District Court for the Eastern District of Pennsylvania identify the suspect as Edward Dubrovsky, though the filings also list conflicting spellings of his last name as “Dobrovsky” or “Dobrosky.” He faces two criminal charges: conspiracy to threaten to impair the confidentiality of information with the intent to extort money, and interference with commerce by threats. The allegations have not been proven in court.

Prison records show a 54-year-old named Edward Dubrovsky is being held at a federal detention center in Philadelphia. Reuters, citing sources familiar with the matter, identified the arrested individual as Ed Dubrovsky, a Canadian cybersecurity executive whose career centered on helping clients negotiate with ransomware attackers. According to CBC News, electronic wallet records leaked in 2010 and preserved by dark-web intelligence firm District 4 Labs identify Dubrovsky as a 54-year-old resident of Richmond Hill, a suburb of Toronto.

The arrest has sent shockwaves through the cybersecurity industry. “For the cybersecurity community in general, I think that there’s a sense of shock,” Toronto-based tech and cybersecurity analyst Ritesh Kotak told CBC News on Monday. Kotak described Dubrovsky as “very popular” and a frequent speaker at conferences, but stressed the charges “are clearly just allegations” and that it is not yet known “what exactly has happened.” He added: “This is an individual that was for the most part respected when it came to ransomware negotiations. A lot of people are familiar with his work as well.”

Dubrovsky’s LinkedIn profile lists him as a specialist in negotiating with cybercriminals over ransom payments and a “globally recognized cybersecurity expert, business leader, speaker, author and educator.” He has held senior cybersecurity positions for decades, according to his profile. He is also the author of a book titled “Cyber Extortion: Strategic Response,” according to SecurityWeek, or “Cyber Extortion: Strategic Response” as reported by CBC News. In the book’s introduction, Dubrovsky wrote: “I have negotiated with criminals who viewed themselves as martyrs, criminal masterminds, and patriots of their own countries even after deploying malware against critical infrastructure and causing billions of dollars in damage. Such people could still look in the mirror and see goodness.”

Dubrovsky appears to be affiliated with Toronto-based CyberSteward, which offers ransomware negotiation services. He wrote on LinkedIn last month that he would be attending the NetDilligence conference in Philadelphia in October with the firm. The company posted photos of Dubrovsky at the conference a week ago and said he was signing copies of his book. CBC News reached out to CyberSteward by phone, email and in person at its Toronto address but did not receive a response Monday.

The Royal Canadian Mounted Police confirmed it is aware of the arrest. RCMP spokesperson Ian Lordon told The Canadian Press that the force “is aware of the arrest of a Canadian in the U.S. in connection with the ShinyHunters hack,” but directed further questions to the FBI. The FBI’s national press office declined to comment directly on Dubrovsky’s arrest and referred inquiries to Patel’s statement.

ShinyHunters is one of the world’s most prolific data theft and extortion groups, typically demanding ransom payments in exchange for not releasing stolen data. The group has been tied to major campaigns, including a recent breach of FBI employee data via the FBIjobs.gov website, a cyberattack on the Canvas learning management system used by universities worldwide, and attacks affecting companies including Telus, Microsoft, Ticketmaster, and Rockstar Games.

The ShinyHunters probe has broadened in recent weeks. According to SecurityWeek, this is the third suspect arrested in the investigation. One alleged key member was arrested in the Netherlands on September 15, and another was reportedly arrested in Jordan on September 28 and is cooperating with the FBI. In late September, ShinyHunters appeared defiant, posting statements that its operations and infrastructure remained unaffected and urging victims to pay up. Those statements were later removed from the group’s Tor-based website, which no longer appears accessible.

SecurityWeek reported that sources told cybersecurity journalist Brian Krebs that executives at other firms offering ransomware negotiation services could face charges in this case.

The case has been moved to the Eastern District of Texas, where the FBI’s ShinyHunters probe is reportedly being run, according to court records.