Cyber News Dark Reading 3 days ago

Prominent Ransomware Negotiator Faces Extortion Charges

CN
CyberNew Threat Research Desk
• Original Reporting: Dark Reading
CyberNew Threat Intel Assessment
Assessed Severity: INFORMATIONAL
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Cyber News

Analyst Takeaway

"US authorities last week charged a ransomware negotiator over alleged extortion activity — the latest example of cybersecurity professionals being implicated in the very activity they're supposed to defend against. Edward Dubrovsky, 54, was charged for conspiracy to threaten to impair the confidentiality of information with the intent to extort money, under 18 U.S.C. § 1030(a)(7)(B), a federal..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

US authorities last week charged a ransomware negotiator over alleged extortion activity — the latest example of cybersecurity professionals being implicated in the very activity they're supposed to defend against.

Edward Dubrovsky, 54, was charged for conspiracy to threaten to impair the confidentiality of information with the intent to extort money, under 18 U.S.C. § 1030(a)(7)(B), a federal provision of the Computer Fraud and Abuse Act (CFAA).

While the exact context of the charge remains unclear, as the main complaint is still sealed, what is particularly notable about this case is Dubrovsky's prominence within the security community as both an executive and an established ransomware negotiator. Prior to these charges, he regularly shared his expertise with various publications, including Dark Reading. He also recently self-published a strategic guidebook discussing best practices for responding to cyber-extortion attempts.

Related:Is It Fair to Blame 'Rogue' AI for Security Failures?

Based in Canada, Dubrovsky is associated with a number of cybersecurity firms. He previously was an executive at Cypfer, an incident response firm, from 2022 until the end of 2025, and is a member of the advisory board at FileFlex, a zero-trust product vendor. He also recently attended a cybersecurity conference in Philadelphia with a firm he said he currently works with, cybersecurity advisory firm CyberSteward.

Dark Reading reached out to Cypfer, CyberSteward, and FileFlex parent company Qnext for comment, but none responded by press time.

Possible ShinyHunters Connection

None of the publicly available documents involving Dubrovsky tie his arrest to a specific incident. However, FBI Director Kash Patel said in a post to X Friday that the bureau "arrested another suspected co-conspirator of the ShinyHunters group — the group believed to be responsible for the recent FBIjobs.gov incident, which occurred on a platform managed by a third-party vendor."

While Patel did not identify the suspect, several factors suggest Dubrovsky may be the individual referenced in the post. A Philadelphia judge sent Dubrovsky's case to Texas, where a source told KrebsOnSecurity recent ShinyHunters investigations are centralized. Furthermore, The New York Times on Friday reported that the FBI arrested a Canadian man in Pennsylvania suspected of working with ShinyHunters.

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from Dark Reading.

Primary Advisory →