Agents with the Federal Bureau of Investigation (FBI) arrested the co-founder of a Canadian cybersecurity company on Thursday as part of an investigation into Shining Hunters hacking group that recently unloaded sensitive data on thousands of agents to the FBI, multiple sources tell KrebsOnSecurity.
The New York Times reported today that the FBI arrested a Canadian in Pennsylvania on suspicion of helping ShinyHunters. The Times article did not identify the man, nor did a statement on Twitter/X regarding the arrest of Kash Patel, Director of the FBI.
A source close to the investigation told KrebsOnSecurity that the Canadian person arrested this week was traveling to Pennsylvania for a cyber insurance conference and that the suspect’s company specialized in handling ransomware negotiations with cybercrime groups. Another said control of the ShinyHunters investigation had been centralized at an FBI field office in Texas.
An online search reveals that the Cyber Risk Summit was held at the Loews Philadelphia Hotel between October 5 and 7. The conference had several sponsors, but according to the summit website, its main sponsor was a Canadian security company called Figure.
According to LinkedIn, Cypher was co-founded by a Canadian named Edward Dubrovskywhich is now associated with another Canadian security company and sponsor called CyberSteward. In a LinkedIn post about a month ago, Dubrovsky said he planned to attend the Cyber Risk Summit with the rest of the CyberSteward team.
Edward Dubrovsky’s LinkedIn profile.
“Looking forward to continued conversations around strategy and coercive (ransomware, extortion) advisory, trading and settlement services that are global and truly agnostic,” Dubrovsky wrote.
Federal court records show that on October 8, one Edward Dobrovsky (note the slight misspelling of the last name) was arrested in Pennsylvania on charges of cyberextortion and conspiracy. Several of those documents – including the main complaint – are now sealed. But a handful of them were listed on Courtlistener.com, including a summary of the complaint, which accuses the defendant of “conspiracy to threaten to violate the confidentiality of information with the intent to extort money” and “interference with commerce through threats.”
Image: Courtlistener.com
The inmate locator at US Bureau of Prisons The website reports that Edward Dubrovsky, 54, is currently being held in a federal facility in Philadelphia. But court records indexed by CourtListener include a notice filed Oct. 9 that moved the case to the Eastern District of Texas, which sources say is now the epicenter of the FBI’s ShinyHunters investigation. The FBI declined to comment for this story.
Dubrovsky’s LinkedIn profile states that he is the author of Strategic response to cyber extortiona 252-page book that promises to “take readers beyond the ransom note and into the decisions that determine how an organization responds, recovers, and protects what matters.”
Edward Dubrovsky’s book, which focuses on the intricacies of ransomware negotiations.
“At the heart of the book is a key distinction: communicating with a criminal is not the same as negotiating payment, and negotiating is not a commitment to pay,” reads an excerpt of the book’s listing on Amazon. “Engagement can serve other purposes, including testing claims, gathering information, saving time, and preserving options while the organization evaluates its next step.” »
Mr. Dubrovsky could not immediately be reached for comment. KrebsOnSecurity also sought comment from CyberSteward’s other co-founder and will update this post if they respond. Court records available in Dubrovsky’s case show that he does not currently have an attorney and has not yet been appointed a public defender by the courts.
ShinyHunters typically uses phishing and stolen credentials to siphon data from corporate accounts of software-as-a-service companies, then threatens to publish the stolen data online unless a ransom demand is paid. According to the FBI, the group has extorted more than $70 million from victims so far this year.
Sources tell KrebsOnSecurity that the FBI is looking into devices that were seized last month when Dutch police arrested convicted cybercriminal Pepijn van der Stap as part of the ShinyHunters investigation, and that charges could be brought against executives of other companies specializing in ransomware trading.
Immediately after Van der Stap’s arrest, another ShinyHunters member named “Rey» took control of the group and began taunting the FBI over data the group had stolen from the agency’s online recruiting portal, which included everyone’s unit and specialization, as well as medical and psychiatric records.
Last week, Reuters reported that Rey – identified as a teenager named Saif Al-Din Khader – had been arrested and was cooperating with FBI investigators. On October 7, we detailed how Rey was apprehended as the cybercrime group allegedly sought to extort a digital navigation and aviation unit that was divested by Boeing in late 2025.
This is likely a rapidly evolving story. Updates will be noted with timestamps.
Gn bussni
