Krebs names ShinyHunters arrest as a ransomware negotiator

KrebsOnSecurity reports that the man the FBI arrested this week in connection with its ShinyHunters investigation is Edward Dubrovsky, co-founder of the Canadian firm Cypfer, which a source describes as specialising in ransomware negotiations with cybercrime groups. The identification is Krebs's, drawn from sources, LinkedIn and court records; the FBI has not named the man or confirmed the attribution.

What's established

The arrest itself was already public: FBI Director Kash Patel posted on X about an arrest tied to the agency's recruitment-portal breach, and The New York Times reported that agents had detained a Canadian man in Pennsylvania on suspicion of assisting ShinyHunters, without naming him. Krebs now puts a name to that reporting.

Per court records cited by Krebs, the arrest happened on October 8. The Bureau of Prisons inmate locator lists a 54-year-old Edward Dubrovsky at a federal facility in Philadelphia, and an October 9 filing moved the case to the Eastern District of Texas. A CourtListener summary of the complaint lists two counts:

• "conspiracy to threaten to impair the confidentiality of information with the intent to extort money"
• "interference with commerce by threats"

Several filings, including the core complaint, are sealed.

What is not established

Krebs is careful, and so are we. The report does not provide direct evidence tying Dubrovsky to specific crimes; a source says he was in Pennsylvania for the Cyber Risk Summit, where Cypfer was the biggest sponsor. Court records spell the surname "Dobrovsky," a discrepancy Krebs flags. Dubrovsky could not be reached, and the FBI declined to comment.

So the load-bearing claim — that an executive at a ransomware-negotiation firm was arrested as part of an extortion investigation — rests on Krebs's sourcing and the public docket, not on an FBI statement. Treat it as strong reporting, not settled fact.

Why it matters

If the identification holds, it is a striking turn: the business of negotiating down ransoms is lightly regulated, has long drawn questions about conflicts of interest, and sits uncomfortably close to the criminals it bargains with. Krebs reports the FBI puts ShinyHunters' extortion haul this year above $70 million, and that charges against other negotiation-firm principals "may be forthcoming." This is at least the third detention in weeks tied to the group's activity. There is nothing for defenders to patch here — but anyone who has retained a ransomware-recovery or negotiation vendor may want to watch how this docket develops.