Threat Intel
FBI Arrests Ransomware Negotiation Firm Founder Linked to ShinyHunters
The FBI arrested Edward Dubrovsky, co-founder of Cypfer and CyberSteward, in Pennsylvania on charges related to cyber extortion and conspiracy. This arrest connects to the ongoing investigation into the ShinyHunters hacking group, which previously compromised FBI data. Defenders should review policies regarding engagement with ransomware negotiation firms.
What Happened
On October 8th, Edward Dubrovsky was arrested in Pennsylvania on federal charges of conspiracy to threaten data confidentiality for extortion and interference with commerce through threats. Dubrovsky is the co-founder of Cypfer and CyberSteward, companies specializing in ransomware negotiation services. The arrest is linked to the FBI’s investigation into the ShinyHunters hacking group, responsible for recent data breaches, including one targeting the FBI itself.
Impact
This arrest highlights the legal risks associated with engaging ransomware negotiation firms. While these firms offer services to mediate with threat actors, their activities may be considered unlawful, particularly if they facilitate communication with groups involved in significant data breaches. Organizations using or considering such services should be aware of potential legal ramifications.
What to Do
- Review Vendor Risk Management: Evaluate the legal and ethical implications of using ransomware negotiation firms.
- Strengthen Incident Response: Focus on prevention, detection, and internal response capabilities to minimize reliance on external negotiators.
- Legal Counsel Consultation: Seek legal advice regarding the legality of ransomware payments and engagement with negotiation services in your jurisdiction.
ShinyHunters Context
ShinyHunters is a prolific hacking group known for data breaches impacting numerous organizations. Their recent compromise of FBI systems underscores their capabilities and the potential severity of their attacks.
Related articles
ShinyHunters Group Faces Double Arrests; FBI Targets Operations
Two ShinyHunters operatives were detained—Saif al‑Din Khader in Jordan and Pepijn van der Stap in the Netherlands—after the FBI announced its intent to pursue the group. The attackers have targeted high‑profile victims, including the FBI, using social engineering and software exploits such as a PeopleSoft vulnerability.
Read briefing
FBI Arrests ShinyHunters Operatives Following FBIjobs.gov Breach
The FBI detained three individuals linked to the ShinyHunters group after a breach of the FBIjobs.gov domain exposed sensitive employee data. The attack leveraged a known Oracle vulnerability and was traced to an unpatched Accenture contractor. Defenders should verify Oracle patch status, review access controls on recruitment portals, and monitor for similar data exfiltration patterns.
Read briefing
FBI Arrests Suspect in ShinyHunters Data Breach of Internal Agent Records
In September, the ShinyHunters hacking group publicly claimed to have exfiltrated a large set of FBI agent data. The FBI has arrested an associate of the group, marking a significant internal security breach. Defenders should review internal data access controls and monitor for similar exfiltration attempts.
Read briefing
Dutch Police Arrest ShinyHunters Hacker, Threat Actor Linked to Recent FBI Breach
Dutch police have arrested Pepijn van der Stap, a convicted hacker linked to the ShinyHunters extortion group that recently targeted the FBI. The arrest follows his 2023 conviction for multiple intrusions and data theft. Defenders should review ShinyHunters’ tactics and harden defenses against similar attacks.
Read briefing