FBI Arrests Canadian Ransomware Negotiator in ShinyHunters Probe

The FBI has arrested a Canadian cybersecurity executive known for negotiating with ransomware attackers, charging him with conspiracy in connection with the ShinyHunters hacking group’s theft of sensitive FBI employee data.

Edward Dubrovsky was taken into custody in Pennsylvania last week and is being held at a federal detention center in Philadelphia, according to prison records cited by CBC News. Court documents from the U.S. District Court for the Eastern District of Pennsylvania charge him with two counts: conspiracy to threaten to impair the confidentiality of information with the intent to extort money, and interference with commerce by threats. The allegations have not been proven in court.

FBI Director Kash Patel confirmed the arrest on social media Friday, describing Dubrovsky as a “suspected co-conspirator” in the ShinyHunters cyberattack on FBIjobs.gov, which exposed a trove of data about FBI staff. “We will continue to work closely with our partners to disrupt what’s left of the ShinyHunters group and their associates, no matter where they operate,” Patel wrote.

Reuters, citing sources familiar with the matter, identified the suspect as Ed Dubrovsky, a Canadian whose career has focused on helping clients negotiate ransom payments. His LinkedIn profile, as reported by CBC News, describes him as a “globally recognized cybersecurity expert, business leader, speaker, author and educator” with senior positions spanning decades. He recently published a book titled “Cyber Extortion: Strategic Response” and was attending the NetDilligence conference in Philadelphia with Toronto-based cybersecurity firm CyberSteward when he was arrested, according to CBC.

The arrest sent shockwaves through the cybersecurity community. “For the cybersecurity community in general, I think that there’s a sense of shock,” Toronto-based tech and cybersecurity analyst Ritesh Kotak told CBC News. Kotak said Dubrovsky is “very popular” and has spoken at numerous conferences, but stressed the charges “are clearly just allegations.” He added, “This is an individual that was for the most part respected when it came to ransomware negotiations.”

Court records, which are partially sealed, provide conflicting spellings of the suspect’s last name — “Dobrovsky” or “Dobrosky” — and do not identify his age, profession or employer, CBC reported. Prison records show a 54-year-old named Edward Dubrovsky is being held. Reuters reported that electronic wallet records leaked in 2010 and preserved by dark-web intelligence firm District 4 Labs identify Dubrovsky as a 54-year-old resident of Richmond Hill, a suburb of Toronto.

The arrest is the third in recent weeks tied to the ShinyHunters probe, according to SecurityWeek. Authorities arrested one alleged key member in the Netherlands on September 15 and another in Jordan on September 28, who is reportedly cooperating with the FBI. The case against Dubrovsky has been moved to the Eastern District of Texas, where the FBI’s ShinyHunters investigation is being run, SecurityWeek reported. Sources told cybersecurity journalist Brian Krebs that executives at other firms offering ransomware negotiation services could face charges in this case.

ShinyHunters is one of the world’s most prolific data theft and extortion groups, typically demanding ransom payments in exchange for not releasing stolen data. The group has been tied to major campaigns, including a recent breach of FBI employee data, a cyberattack on the Canvas learning management system, and attacks affecting companies including Telus, Microsoft, Ticketmaster, and Rockstar Games, according to CBC and Slashdot.

The FBI blamed the intrusion on a contractor’s failure to patch vulnerable Oracle PeopleSoft software, SecurityWeek reported. The Royal Canadian Mounted Police confirmed it is aware of the arrest but directed further questions to the FBI, according to CBC. The FBI’s national press office declined to comment directly on Dubrovsky’s arrest and referred inquiries to Patel’s statement.