# FBI Arrests Ransomware Negotiation Firm Executive Over ShinyHunters Collusion Canadian cybersecurity advisor faces federal charges after allegedly assisting extortionists targeting agency records. - **Source:** [Krebs on Security](https://brifing.si/source/0a287077-2ca9-4c5d-b9aa-b7b61aa8e436) - **Published:** 2026-10-10 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/94a3b0ea-34c6-4d35-a816-d008c1277e67 ## Negotiation Executive Taken Into Custody Federal agents arrested Canadian cybersecurity executive Edward Dubrovsky in Pennsylvania during an industry conference. Authorities accuse the ransomware negotiation specialist of actively assisting the ShinyHunters cybercrime syndicate. The group recently breached sensitive federal databases, compromising personal, medical, and psychiatric records belonging to thousands of FBI personnel. ## Extortion Charges Filed In Federal Court Sealed court records outline charges of conspiracy to impair information confidentiality and interference with commerce through threats. The 54-year-old defendant remains held in a Philadelphia federal detention facility without legal representation. Federal authorities transferred primary jurisdiction of the extortion prosecution to the Eastern District of Texas. ## Specialist Profile Clashes With Accusations Dubrovsky previously served as managing director at Cypfer before associating with CyberSteward, an incident response consultancy. He authored a specialized manual detailing strategic responses to enterprise extortion demands. His professional career focused on negotiating enterprise settlements and handling communications directly with active ransomware operators globally. ## Seized Hardware Unlocks Criminal Operations Federal investigators developed actionable intelligence after Dutch law enforcement arrested convicted hacker Pepijn van der Stap last month. Digital forensics conducted on confiscated electronic devices revealed critical communication channels. Agents discovered evidence connecting external incident response firms directly to ShinyHunters' monetization and coercive extortion infrastructure. ## ShinyHunters Infrastructure Generates Millions ShinyHunters primarily utilizes stolen enterprise credentials and targeted phishing campaigns to infiltrate cloud service providers. Federal tracking indicates the syndicate extorted over $70 million from corporate victims this year. The gang regularly threatened complete data publication unless victims paid substantial cryptocurrency ransoms within strict deadlines. ## Leadership Interception Yields Critical Co-operation Following previous arrests, an operative known as Rey assumed operational leadership before federal capture. Identified as teenager Saif Al-din Khader, the suspect began cooperating with federal investigators. His detention occurred while attempting to extort a specialized digital aviation unit recently divested from commercial aerospace manufacturer Boeing. ## Investigation Expands Across Response Industry Law enforcement sources indicate the Texas field office is scrutinizing multiple incident response organizations. Investigators are assessing whether other private negotiators crossed legal boundaries by coordinating illicit payouts or aiding extortionists. Further indictments targeting principals at third-party ransomware mediation firms may emerge as forensic reviews progress. ## Legal Boundaries Tighten For Negotiators The arrest underscores growing federal scrutiny surrounding commercial intermediaries operating within cyber extortion ecosystems. Organizations utilizing third-party negotiators must recognize heightened regulatory risks when dealing with sanctioned or targeted criminal syndicates. Law enforcement is clearly signaling that facilitation can quickly cross into criminal conspiracy under federal statutes. ## Sources covering this story - https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._