FBI Arrests Canadian Ransomware Negotiation Firm Founder in ShinyHunters Probe

Federal agents arrested Edward Dubrovsky in Pennsylvania on cyber extortion charges tied to the ShinyHunters hacking group. The arrest expands an FBI investigation that targeted the agency's own data and the firms that negotiate with ransomware gangs.

Federal Bureau of Investigation agents arrested Edward Dubrovsky, co-founder of the Canadian cybersecurity firm CyberSteward, in Pennsylvania on Thursday. Court records list cyber extortion and conspiracy charges against the suspect.

The arrest centers on the ShinyHunters hacking group, which stole sensitive data belonging to thousands of FBI agents. The New York Times reported the arrest first. FBI Director Kash Patel did not identify the suspect in a statement on X.

Court records show an Edward Dobrovsky, a misspelling of the suspect's name, entered the case Oct. 8. A summary of the complaint charges him with conspiracy to threaten to impair the confidentiality of information with the intent to extort money. The complaint also lists interference with commerce by threats. Several documents, including the main complaint, remain sealed.

The U.S. Bureau of Prisons inmate locator lists a 54-year-old Edward Dubrovsky at a federal facility in Philadelphia. CourtListener indexes a notice filed Oct. 9 that moved the case to the Eastern District of Texas. Sources said this office leads the ShinyHunters investigation.

Dubrovsky visited Pennsylvania for the Cyber Risk Summit, held Oct. 5 to Oct. 7 at the Loews Philadelphia Hotel. CyberSteward the event. The summit's website lists Cypfer as its biggest sponsor. Dubrovsky's profile links him to both firms.

a month ago, Dubrovsky wrote on that he planned to ransomware advisory, negotiations, and settlement services that are global and agnostic. He also posted plans to attend the Cyber Risk Summit with the CyberSteward team.

Court records show Dubrovsky does not have an attorney. The court has not yet appointed a public defender.

The group uses phishing and stolen credentials to access corporate accounts at software-as-a-service companies. It threatens to publish stolen data online unless victims pay a ransom. The FBI says the group extorted more than $70 million this year.

Agents review devices seized last month when Dutch police arrested convicted cybercriminal Pepijn van der Stap in connection with the investigation. Sources said the FBI may charge principals at other companies that specialize in ransomware negotiation.

After van der Stap's arrest, another member of ShinyHunters known as "Rey" took control of the group. The group taunted the FBI over data it stole from the agency's online recruitment portal. The leak included each agent's unit and specialization, plus medical and psychiatric records.

Reuters identified Rey as a teenager named Saif Al-din Khader. Investigators detained him. He cooperates with investigators.

Investigators apprehended Rey on Oct. 7. The group allegedly sought to extort a and digital aviation unit divested by Boeing in late 2025.

Dubrovsky's profile lists him as the author of Cyber Extortion Strategic Response, a 252-page book. An excerpt from the book's Amazon listing reads: "At the heart of the book is a critical distinction: communicating with a criminal is not the same as negotiating a payment, and negotiating is not a commitment to pay."

Dubrovsky did not respond to requests for . Reporters also sought from CyberSteward's other co-founder.

The FBI declined to .

View the complaint summary on CourtListener

the U.S. Bureau of Prisons inmate locator

View Dubrovsky's profile

Source : krebsonsecurity.com