Canadian cybersecurity executive Edward Dubrovsky was arrested in Pennsylvania in connection with alleged extortion activities that multiple reports have linked to the FBI’s ongoing crackdown on the ShinyHunters hacking group.
Dubrovsky, 54, has held senior positions at cybersecurity firms that help victims of data breaches and ransomware negotiate extortion payments with cybercriminals.
Yesterday, FBI Director Kash Patel announced that agents had arrested “another suspected co-conspirator of the ShinyHunters group.” The New York Times reported that the suspect was a Canadian citizen arrested in Pennsylvania and was believed to be a key co-conspirator in the recent FBI Jobs hack attack on ShinyHunters.
Last night, both Politically And CancerOnSecurity reported that Dubrovsky was arrested in Pennsylvania, where he was attending a cybersecurity conference.
Publicly available Court records show that Dubrovsky appeared after his incarceration in the Eastern District of Pennsylvania. A later one Court order says he was transferred to the Eastern District of Texas, where the charges were filed, with an order that he remain in custody.
While the complaint is currently under seal, the filing lists allegations related to conspiracy and extortion.
“18:371 and 1030(a)(7)(B) – CONSPIRACY to threaten to impair the confidentiality of information with the intent to extort money; 18:1951(a) and (b)(2) – Interfere with commerce by threats (HOBBS ACT extortion and conspiracy to commit HOBBS ACT extortion),” the statement reads Case file.
While the FBI has not publicly confirmed that Dubrovsky is the alleged ShinyHunters co-conspirator, KrebsOnSecurity reports that multiple sources linked Dubrovsky’s arrest to the ShinyHunters investigation.
Dubrovsky previously co-founded Canadian cybersecurity company CYPFER and was also associated with CyberSteward, another company specializing in ransomware negotiation and cyber extortion response.
Politico reports that CyberSteward is a trade name used by CYPFER and that the firms help organizations negotiate and send extortion payments to cybercriminals.
Dubrovsky also recently published a book called “Cyber Extortion Strategic Response” about dealing with cyber extortion.
According to KrebsOnSecurity, Dubrovsky had previously posted LinkedIn that he planned to attend the NetDiligence Cyber Risk Summit in Pennsylvania with the CyberSteward team.
ShinyHunters is an extortion group known for stealing data from web applications and cloud-based SaaS platforms and then demanding ransom payments from victims otherwise the stolen data would be made public.
Over time, the ShinyHunters name has been used by numerous threat actors involved in data theft and extortion campaigns worldwide.
In addition to its own security breaches, the group also operated as an extortion-as-a-service company, helping other hackers blackmail organizations they had already compromised into paying ransom demands.
More recently, ShinyHunters has increasingly targeted cloud environments and enterprise SaaS platforms, often using stolen credentials, authentication tokens, phishing and social engineering to gain access to enterprise systems and steal data.
According to the FBI, ShinyHunters and associated actors hacked more than 140 organizations last year and collected more than $70 million in extortion payments.
The FBI has increased pressure on the group since the hack of its job portal, making several arrests and detentions related to suspected ShinyHunters members in recent weeks.
Because the lawsuit against Dubrovsky remains sealed, it is still unclear what he is accused of and whether the case is related to the FBI breach.
