Edward Dubrovsky spent his career sitting across the table from extortionists. Now the FBI says he may have been working with them. The 54-year-old Canadian cybersecurity executive was arrested in Pennsylvania on a Thursday while attending a cyber risk conference in the Philadelphia area, part of the bureau’s widening pursuit of the ShinyHunters hacking group.
FBI Director Kash Patel did not name anyone when he announced on social media that agents had taken “another suspected co-conspirator of the ShinyHunters group” into custody. The identification came from the press. Reuters, citing sources familiar with the matter, named Dubrovsky, and Politico and KrebsOnSecurity reported that he was arrested at the conference. The New York Times described the suspect as a Canadian citizen believed to be a primary co-conspirator in the recent hack of FBIjobs.gov. The FBI’s press office declined to comment on the arrest and pointed to Patel’s statement.
The charges
Court records show two counts: conspiracy to threaten to impair the confidentiality of information with the intent to extort money, and interference with commerce by threats. The docket cites Hobbs Act extortion and conspiracy. The allegations have not been proven in court.
The paperwork is untidy. The complaint is sealed, and the partially sealed records spell the surname variously as “Dobrovsky” or “Dobrosky” and give no age, profession or employer. Prison records show a 54-year-old Edward Dubrovsky held at a federal detention centre in Philadelphia. A later order says he was moved to the Eastern District of Texas, where the charges were filed. Because the complaint stays under seal, it is still unclear what he is accused of doing, or whether the case ties to the FBI breach at all. The FBI has not publicly said he is the suspected co-conspirator Patel mentioned.
A negotiator’s résumé
Dubrovsky is known for the work of talking to criminals on behalf of their victims. He co-founded the Canadian firm CYPFER and has been linked to CyberSteward, which Politico reports is a trade name used by CYPFER. Both help organisations negotiate and send extortion payments, whether to get data decrypted or to have it deleted. Reuters cited leaked electronic wallet records from 2010, preserved by the dark-web intelligence firm District 4 Labs, that identify him as a resident of Richmond Hill, outside Toronto.
He had recently published a book, “Cyber Extortion Strategic Response”. CyberSteward posted photos of him signing copies at the conference a week before the arrest. In the introduction he writes of negotiating with criminals who saw themselves as martyrs, masterminds or patriots, adding that “such people could still look in the mirror and see goodness.”
Colleagues in Canada were stunned. Toronto analyst Ritesh Kotak told CBC News that Dubrovsky was “very popular” and “for the most part respected” for his ransomware negotiation work, while stressing that the charges “are clearly just allegations.” David Shipley, CEO of Beauceron Security in Fredericton, said he felt for Dubrovsky’s former colleagues, “dragged through these awful headlines.” The RCMP said it was aware of the arrest and referred questions to the FBI. CBC could not reach CyberSteward.
The group behind it
ShinyHunters steals data from web applications and cloud SaaS platforms, then demands payment or threatens to publish. The name has been worn by many threat actors, and the group has also run extortion-as-a-service for other hackers. Under the hood, it leans on stolen credentials, authentication tokens, phishing and social engineering. The FBI says ShinyHunters and associated actors have breached more than 140 organisations and collected over $70 million in extortion payments in the past year.
The July breach of DentaQuest, the second-largest dental insurer in the United States, hit roughly 15 million people. In August the group claimed records on “tens of millions” of patients and more than 284 million documents from the distributor McKesson, via phishing, as CyberInsider first reported. Medtronic was hit in April, with the data offered for sale on the gang’s dark web blog. In May an attack on the Canvas learning platform disrupted universities worldwide, Canadian ones included.
The FBI data theft came last month. ShinyHunters said it took job assignments, addresses and social security numbers of officials, in retaliation for what it called false claims by the bureau, and later told CBC it would not release the data. Shipley said the stunt “poked the bear.” Patel promised to “disrupt what’s left of the ShinyHunters group,” and arrests and detentions linked to alleged members have followed in recent weeks.
Sources
- Canadian cybersecurity executive arrested as FBI cracks down on ShinyHunters ransomware gang
- Cyber exec arrested in case allegedly tied to ShinyHunters hackers
- A prominent Canadian cybersecurity expert has been arrested in the ShinyHunters hacking investigation | CBC News
