Summary
- FBI arrested Edward Dubrovsky, co-founder of Canadian firms Cypfer and CyberSteward, in Pennsylvania on 8 October on cyber extortion and conspiracy charges.
- Dubrovsky’s companies specialised in ransomware negotiation services; he was attending a cyber insurance conference at the time of his arrest.
- The case has been transferred to the Eastern District of Texas, which sources indicate is the hub of the FBI’s broader ShinyHunters investigation.
- ShinyHunters has reportedly extorted more than $70 million from victims this year, targeting corporate SaaS accounts via phishing and credential theft.
- Sources suggest charges against principals at other ransomware negotiation firms may be forthcoming as the investigation widens.
The Arrest
FBI agents arrested a 54-year-old Canadian national, Edward Dubrovsky, in Pennsylvania on 8 October, according to federal court records and multiple sources cited by KrebsOnSecurity. Dubrovsky is co-founder of Canadian cybersecurity companies Cypfer and CyberSteward, both of which offer ransomware negotiation and extortion response services. He was in Philadelphia attending the Cyber Risk Summit — a conference at which CyberSteward was listed as a sponsor — when agents took him into custody.
The Charges
Court records indexed by CourtListener show Dubrovsky faces charges of conspiracy to threaten to impair the confidentiality of information with intent to extort money, and interference with commerce by threats. Several documents in the case, including the core complaint, have since been sealed. A notice filed on 9 October transferred the matter to the Eastern District of Texas, which sources describe as the operational centre of the FBI’s ShinyHunters investigation. As of the time of reporting, Dubrovsky had not secured legal representation and had not been appointed a public defender.
The ShinyHunters Connection
The FBI’s investigation centres on the ShinyHunters hacking group, which typically compromises corporate SaaS accounts through phishing and stolen credentials, then threatens to publish stolen data unless ransoms are paid. The group has reportedly extorted more than $70 million from victims this year alone. The investigation gained considerable momentum after Dutch police arrested convicted cybercriminal Pepijn van der Stap last month in connection with the same group. Sources tell KrebsOnSecurity that FBI investigators have been examining devices seized in that Dutch operation.
A Widening Investigation
The ShinyHunters case has attracted significant attention in recent months. Following Van der Stap’s arrest, a group member known as Rey assumed leadership and publicly taunted the FBI after the group stole data from the agency’s online recruitment portal — data that included personnel unit details, specialisations, and medical and psychiatric records. Reuters subsequently reported that Rey, identified as a teenager named Saif Al-din Khader, had been detained and was cooperating with FBI investigators. Separately, the group allegedly sought to extort a navigation and digital aviation unit that had been divested by Boeing in late 2025.
The Negotiator’s Own Words
Dubrovsky’s LinkedIn profile describes him as the author of Cyber Extortion Strategic Response, a book focused on how organisations navigate ransomware incidents. An excerpt from the book’s Amazon listing draws a careful distinction that now reads with some irony: the text argues that communicating with criminals is not equivalent to negotiating payment, and that engagement can serve legitimate objectives such as gathering intelligence and preserving options. About a month before his arrest, Dubrovsky posted on LinkedIn that he was looking forward to attending the Cyber Risk Summit to discuss ransomware advisory, negotiation, and settlement services.
More Arrests Possible
Sources familiar with the investigation have told KrebsOnSecurity that charges against principals at other ransomware negotiation firms may be forthcoming. The FBI declined to comment. CyberSteward’s other co-founder had not responded to a request for comment at the time of publication. The FBI Director referenced the arrest publicly on Twitter/X without naming the individual, and The New York Times reported the arrest without identifying the suspect.
Why it matters
This arrest sends a direct signal to the incident response and ransomware negotiation sector: the FBI is scrutinising not only the criminal groups conducting extortion but also the intermediaries facilitating those interactions. For CISOs, it raises immediate due diligence obligations around the third-party negotiation firms engaged during ransomware incidents. If a vendor engaged to manage an extortion event is itself under investigation — or charged — the organisation retains exposure and may face complications with its own legal and regulatory obligations. It also reinforces that the legal boundary between legitimate negotiation and criminal facilitation is being actively tested by law enforcement, and that any firm operating in this space should be evaluated accordingly.
What to do now
- Review contracts and due diligence records for any ransomware negotiation or incident response vendors currently on retainer, paying particular attention to their regulatory compliance posture and references.
- Consult legal counsel about the implications of engaging third-party negotiators during active ransomware incidents, given the evolving legal landscape around extortion facilitation.
- Monitor developments in the ShinyHunters investigation, as sources indicate further charges against negotiation firm principals may be forthcoming — additional vendors may be implicated.
- Assess whether your organisation’s SaaS accounts and credential management practices are sufficiently hardened against the phishing and credential-theft techniques ShinyHunters is known to use.
- Ensure your incident response plan includes internal legal review before any engagement with a ransomware threat actor, whether conducted directly or through a third party.
