-
US officials charged well-known cybersecurity executive Edward Dubrovsky with conspiracy to extort money last week.
-
Investigators may be linking Dubrovsky’s arrest to the hacking group ShinyHunters, based on a recent post from the FBI director.
-
Two other ransomware negotiators, Zohar Pinhasi and Angelo Martino, also face serious legal trouble this year.
US authorities arrested a ransomware negotiator last week. They charged him with extortion. The case shows that even cybersecurity experts can end up committing the crimes they fight.
Edward Dubrovsky is 54 years old. He has spent years helping companies handle hackers. Officials accuse him of conspiring to threaten the release of private information so he could demand money. Prosecutors filed this charge under 18 U.S.C. § 1030(a)(7)(B), a federal law called the Computer Fraud and Abuse Act.
Details Behind the Arrest
The full complaint against Dubrovsky stays sealed right now. That means the public cannot see every detail yet. Still, his case stands out because of who he is.
Dubrovsky built a strong name in the security world. He worked as both a company executive and a ransomware negotiator. He often shared advice with cybersecurity publications before his arrest. He also wrote his own guidebook about handling cyber-extortion, which he published not long ago.
Dubrovsky lives in Canada and has ties to several cybersecurity firms. He worked as an executive at Cypfer, an incident response company, from 2022 through late 2025. He also sits on the advisory board of FileFlex, a company that builds security products. He recently told people he works with another firm, CyberSteward, and attended a cybersecurity event with that company in Philadelphia.
Reporters reached out to Cypfer, CyberSteward, and FileFlex’s parent company for comment. None of the three had responded by the time this story was written.
A Possible Tie to ShinyHunters
No public document connects Dubrovsky’s arrest to one specific hacking case. However, FBI Director Kash Patel shared new details on social media last Friday. On X, Patel said agents arrested another person suspected of working with the hacking group ShinyHunters. He added that investigators believe this group caused the recent break-in at the FBIjobs.gov website, which ran on a system managed by an outside company.
Patel did not name the suspect in his post. Still, several clues point toward Dubrovsky. A judge moved his case from Philadelphia to Texas. A report said Texas now handles many recent cases tied to ShinyHunters. Another report said the FBI arrested a Canadian man in Pennsylvania on suspicion of working with the group.
ShinyHunters is a group of hackers known for stealing data and demanding payment. The group has been blamed for past attacks involving Salesforce systems. It has also targeted several colleges and universities.
Cybercrime investigations also target the financial networks that help illicit marketplaces operate, including a case in which US authorities froze $52.8 million in cryptocurrency linked to the Xinbi scam marketplace.
More importantly, ShinyHunters claimed it broke into a jobs website used by the FBI last month. The group said it stole data linked to nearly every FBI worker and job applicant. Since that attack, the FBI has worked hard to track down members of the group. Agents have already made several arrests.
Other Negotiators Facing Charges Too
Dubrovsky is not the only ransomware negotiator in legal trouble this year. Last week, prosecutors in New York charged another negotiator, Zohar Pinhasi, with wire fraud. Officials say Pinhasi ran a ransomware recovery company called MonsterCloud. They claim he told clients he could unlock their files without paying hackers. Instead, prosecutors allege he secretly paid the criminals himself, then charged his clients a much higher price.
A separate case involved negotiator Angelo Martino. Courts convicted Martino for sharing private details with the BlackCat ransomware gang in exchange for payment.
Jeff Wichman works as a senior director at the cybersecurity firm Semperis. He focuses on breach preparedness and response. According to Wichman, cases like these could push ransomware negotiation companies to tighten how they screen new hires. He also expects these firms to face closer review from insurance companies, including those that back ransomware negotiators financially.
Court records show that Dubrovsky had a public defender represent him at his first court appearance. His case remains active, and prosecutors have not shared every detail publicly yet. The outcome could shape how companies choose and trust negotiators going forward.
