A Canadian ransomware negotiator was arrested Thursday in Pennsylvania and faces federal extortion charges, Reuters reported, as the FBI cracks down on the hacking group ShinyHunters — the crew that defaced the FBI's jobs site last month and demanded the bureau retract a May warning about the group.
Court documents filed with the Eastern District of Pennsylvania charge 54-year-old Edward Dubrovsky with conspiracy to "threaten to impair the confidentiality of information with intent to extort money," plus Hobbs Act extortion charges. The records are partially sealed, and the docket even misspells his last name as "Dobrovsky" or "Dobrosky." Federal prison records show a 54-year-old Edward Dubrovsky is currently held at a federal detention center in Philadelphia.
The irony is hard to miss: Dubrovsky's profession is telling companies how to handle ransomware attacks. His LinkedIn-listed company, CyberSteward, advertises expertise in "threat actor engagement, cyber-extortions, complex negotiations, and settlement facilitation" — in plain terms, negotiating ransom payments with cybercriminals on behalf of victim companies. Electronic wallet records preserved by dark-web intelligence firm District 4 Labs identify Dubrovsky as a resident of Richmond Hill, north of Toronto, aged 54. Reuters' repeated attempts to reach him, his attorneys, and CyberSteward went unanswered.
Anonymous sources say the case is connected to ShinyHunters, the group that defaced the FBI's jobs site last month while demanding the bureau retract its May warning about the hacking crew. The FBI director announced Friday on social media that agents had arrested "another suspected co-conspirator of the ShinyHunters group," without naming the suspect. According to Gizmodo, the criminal complaint against Dubrovsky was actually filed in the Eastern District of Texas and remains under seal; a Philadelphia magistrate judge ordered him held and sent to Texas for a detention hearing.
News of the arrest was first reported by Politico and independent journalist Brian Krebs. Dubrovsky has not been convicted and has not entered a plea, and neither prosecutors nor the defense have commented publicly. The ransomware-negotiation business has always operated in a gray zone: its practitioners help victims drive down ransom demands and recover data, while critics question how close they get to the criminals. With a negotiator now accused of extortion himself, the industry's compliance boundaries are likely to face fresh scrutiny.