FBI Arrests Canadian Ransomware Negotiator in ShinyHunters Crackdown

The FBI last week arrested Edward Dubrovsky, a Canadian cybersecurity executive specializing in ransomware negotiations, in connection with the ShinyHunters hacking group’s recent cyberattack on the FBI’s jobs website, according to court documents and statements from FBI Director Kash Patel.

Dubrovsky faces two criminal charges in the U.S. District Court for the Eastern District of Pennsylvania: conspiracy to threaten to impair the confidentiality of information with the intent to extort money, and interference with commerce by threats. The allegations have not been proven in court. The case has since been moved to the Eastern District of Texas, where the FBI’s ShinyHunters investigation is being run.

Patel confirmed the arrest on social media Friday, calling Dubrovsky a “suspected co-conspirator.” “This is the latest arrest this FBI has made in a matter of days involving this network, as we work non-stop to dismantle the group, pursue new leads and evidence, and act quickly,” Patel stated. “We will continue to work closely with our partners to disrupt what’s left of the ShinyHunters group and their associates, no matter where they operate.”

Dubrovsky was arrested after traveling to Philadelphia for a conference, according to securityweek.com. Reuters, citing sources familiar with the matter, identified the suspect as Ed Dubrovsky, a Canadian cybersecurity executive whose career focused on ransomware negotiations. Prison records show a 54-year-old named Edward Dubrovsky is being held at a federal detention centre in Philadelphia. Electronic wallet records preserved by dark-web intelligence firm District 4 Labs identify Dubrovsky as a 54-year-old resident of Richmond Hill, a suburb of Toronto, CBC News reported.

Dubrovsky’s LinkedIn profile describes him as a specialist in negotiating with cybercriminals over ransom payments and a “globally recognized cybersecurity expert, business leader, speaker, author and educator.” He has held senior cybersecurity positions for decades. He is affiliated with Toronto-based CyberSteward, a firm offering ransomware negotiation services, and recently published a book titled “Cyber Extortion: Strategic Response.” In the book’s introduction, Dubrovsky wrote: “I have negotiated with criminals who viewed themselves as martyrs, criminal masterminds, and patriots of their own countries even after deploying malware against critical infrastructure and causing billions of dollars in damage. Such people could still look in the mirror and see goodness.”

The arrest has sent shockwaves through the cybersecurity community. “For the cybersecurity community in general, I think that there’s a sense of shock,” Toronto-based tech and cybersecurity analyst Ritesh Kotak told CBC News. Kotak said Dubrovsky is “very popular” and has spoken at numerous conferences, but stressed the charges “are clearly just allegations” and that it is not yet known “what exactly has happened.” “This is an individual that was for the most part respected when it came to ransomware negotiations,” Kotak added.

ShinyHunters is one of the world’s most prolific data theft and extortion groups. The group recently claimed responsibility for hacking the FBI’s jobs website, FBIjobs.gov, allegedly obtaining information on nearly all agents and job applicants. The FBI attributed the intrusion to a contractor’s failure to patch vulnerable Oracle PeopleSoft software. The hackers said they carried out the attack in response to an FBI report warning organizations about ShinyHunters activity. The group has also been tied to high-profile breaches affecting companies including Telus, Microsoft, Ticketmaster, Pornhub, Rockstar Games, and the Canvas online learning platform that disrupted universities worldwide in May.

Dubrovsky’s arrest is the third in recent weeks linked to ShinyHunters. Authorities arrested one alleged key member in the Netherlands on September 15, and another alleged key member was reportedly arrested in Jordan on September 28 and is cooperating with the FBI. In late September, ShinyHunters appeared defiant, stating its operations and infrastructure remained unaffected and urging victims to pay up. Those statements were later removed from the group’s Tor-based website, which no longer appears accessible.

Securityweek.com, citing cybersecurity blogger Brian Krebs, reported that sources said executives at other firms offering ransomware negotiation services could face charges in this case.

The Royal Canadian Mounted Police confirmed it is aware of the arrest of a Canadian in the United States in connection with ShinyHunters, but directed further questions to the FBI. The FBI’s national press office declined to comment directly on Dubrovsky’s arrest, referring inquiries to Patel’s statement.