FBI Arrests Founder of a Ransomware Negotiation Firm

FBI agents on Thursday arrested the co-founder of a Canadian cybersecurity firm as part of the investigation into the hacking group ShinyHunters — the same crew that recently stole sensitive data on thousands of the agency's own employees, sources tell KrebsOnSecurity.

The New York Times reported that the FBI had detained a Canadian man in Pennsylvania on suspicion of assisting ShinyHunters. Neither the paper nor a statement from FBI Director Kash Patel on X named the suspect.

A negotiator on the other side of the table

According to a source close to the case, the man had come to Pennsylvania for a cyber insurance conference, and his company specialized in handling ransomware negotiations. The Cyber Risk Summit ran at the Loews Philadelphia Hotel from Oct. 5 to Oct. 7; its biggest sponsor, per the event site, was a Canadian firm called Cypfer.

LinkedIn shows Cypfer was co-founded by a Canadian named Edward Dubrovsky, now associated with another firm, CyberSteward. About a month ago he wrote that he planned to attend the summit with the CyberSteward team, promising to continue conversations about advisory, negotiation and settlement services in extortion cases.

Federal court records show that on October 8, an Edward Dobrovsky (the last name slightly misspelled) was arrested in Pennsylvania on cyber extortion and conspiracy charges. The core documents are now sealed, but a summary charges the defendant with "conspiracy to threaten to impair the confidentiality of information with the intent to extort money" and "interference with commerce by threats."

The Bureau of Prisons inmate locator lists a 54-year-old Edward Dubrovsky held in Philadelphia. Yet on October 9 the case was moved to the Eastern District of Texas — which sources say is now the epicenter of the ShinyHunters probe.

A book on how to talk to criminals

In a twist that's hard to miss, Dubrovsky is the author of a 252-page book, "Cyber Extortion Strategic Response." At its heart is the claim that communicating with a criminal is not the same as negotiating a payment, and negotiating is not a commitment to pay. Engagement, he argues, can serve other ends: testing claims, gathering information, buying time.

ShinyHunters typically uses phishing and stolen credentials to siphon data from corporate SaaS accounts, then threatens to publish it unless paid. The FBI says the group has extorted more than $70 million this year.

Sources say the FBI is combing through devices seized when Dutch police arrested cybercriminal Pepijn van der Stap, and that charges against other negotiation firms may follow. After that arrest, control of the group passed to a member known as "Rey," who began taunting the FBI with its own stolen data. Last week Reuters reported that Rey — a teenager named Saif Al-din Khader — had been detained and was cooperating.

Source: Krebs on Security