Ransomware Negotiator Arrested in FBI's Expanding ShinyHunters Crackdown
A Canadian cybersecurity professional has been arrested in the United States as part of the FBI's ongoing investigation into the ShinyHunters hacking group, which recently claimed to have breached FBI systems.
FBI Director Kash Patel confirmed the arrest on Friday, describing it as part of a rapid series of takedowns targeting the group's network. "We will continue to work closely with our partners to disrupt what's left of the ShinyHunters group and their associates, no matter where they operate," Patel said.
The FBI has not officially identified the suspect, but reporting from The New York Times and security journalist Brian Krebs points to Edward Dubrovsky, a Toronto-based cybersecurity professional who specialises in ransomware response. The Royal Canadian Mounted Police confirmed to CBS News that they are aware a Canadian national has been arrested in the US in connection with the ShinyHunters investigation.
Dubrovsky was reportedly picked up by the FBI after travelling to Philadelphia for a conference. He is suspected of involvement in the ShinyHunters attack on the FBI itself, which the group claimed gave them access to the bureau's jobs portal and internal systems, including data on nearly every FBI agent and job applicant. The hackers framed the attack as retaliation for an FBI advisory warning organisations about ShinyHunters activity. The FBI attributed the breach to a contractor failing to patch vulnerable Oracle PeopleSoft software.
Dubrovsky appears to be affiliated with CyberSteward, a Toronto-based firm offering ransomware negotiation services. His LinkedIn lists executive roles at several North American cybersecurity companies, and he is the author of a book called "Cyber Extortion: Strategic Response." Court documents, which spell his name as Dobrovsky, charge him with conspiracy to threaten to impair the confidentiality of information with intent to extort money, and interference with commerce by threats. The case has since been transferred to the Eastern District of Texas, where the FBI's ShinyHunters investigation is reportedly being coordinated.
This makes three ShinyHunters suspects arrested in recent weeks. One alleged key member was detained in the Netherlands on 15 September. Another was reportedly arrested in Jordan on 28 September and is said to be cooperating with investigators.
ShinyHunters had previously tried to project business-as-usual defiance, posting statements to their Tor-based site claiming their infrastructure was unaffected and telling victims to pay up. Those statements have since disappeared, and the site itself appears to be offline.
Perhaps the most uncomfortable detail in all of this: sources told Krebs that executives at other ransomware negotiation firms could also face charges. The line between incident responder and co-conspirator, it seems, is under active scrutiny.