Prominent Ransomware Negotiator Faces Extortion Charges

Edward Dubrovsky, a longtime cybersecurity executive, was arrested and charged in Pennsylvania last week under conspiracy to extort money.

US authorities last week charged a ransomware negotiator over alleged extortion activity — the latest example of cybersecurity professionals being implicated in the very activity they’re supposed to defend against.

Edward Dubrovsky, 54, was charged for conspiracy to threaten to impair the confidentiality of information with the intent to extort money, under 18 U.S.C. § 1030(a)(7)(B), a federal provision of the Computer Fraud and Abuse Act (CFAA).

While the exact context of the charge remains unclear, as the main complaint is still sealed, what is particularly notable about this case is Dubrovsky’s prominence within the security community as both an executive and an established ransomware negotiator. Prior to these charges, he regularly shared his expertise with various publications, including Dark Reading. He also recently self-published a strategic guidebook discussing best practices for responding to cyber-extortion attempts.

Based in Canada, Dubrovsky is associated with a number of cybersecurity firms. He previously was an executive at Cypfer, an incident response firm, from 2022 until the end of 2025, and is a member of the advisory board at FileFlex, a zero-trust product vendor. He also recently attended a cybersecurity conference in Philadelphia with a firm he said he currently works with, cybersecurity advisory firm CyberSteward.

Dark Reading reached out to Cypfer, CyberSteward, and FileFlex parent company Qnext for comment, but none responded by press time.

Possible ShinyHunters Connection

None of the publicly available documents involving Dubrovsky tie his arrest to a specific incident. However, FBI Director Kash Patel said in a post to X Friday that the bureau “arrested another suspected co-conspirator of the ShinyHunters group — the group believed to be responsible for the recent FBIjobs.gov incident, which occurred on a platform managed by a third-party vendor.”

While Patel did not identify the suspect, several factors suggest Dubrovsky may be the individual referenced in the post. A Philadelphia judge sent Dubrovsky’s case to Texas, where a source told KrebsOnSecurity recent ShinyHunters investigations are centralized. Furthermore, The New York Times on Friday reported that the FBI arrested a Canadian man in Pennsylvania suspected of working with ShinyHunters.

ShinyHunters is a loose collective of threat actors known for data extortion attacks. The group previously was behind a number of highly visible threat campaigns involving compromised Salesforce instances and attacks on higher education institutions.

But perhaps most notably, ShinyHunters last month hacked a third-party jobs site used by the FBI. The group further claimed they stole data belonging to nearly every FBI employee and job applicant. In response, the FBI has aggressively pursued ShinyHunters, making a number of arrests in the process.

Other Legal Issues in the Ransomware Negotiation Industry

Dubrovsky is not the first ransomware negotiator charged in connection with his work. Last week, Zohar Pinhasi was arraigned by the US Attorney’s Office for the Eastern District of New York on wire fraud charges for allegedly defrauding clients of his ransomware remediation company, MonsterCloud. Pinhasi was accused of promising clients that he could decrypt ransomware without paying criminals, only to then pay criminals himself and charge the end customer a substantial markup.

In another case, a ransomware negotiator, Angelo Martino, was convicted for sharing details with the BlackCat ransomware group in exchange for payment.

Jeff Wichman, Semperis senior director of breach preparedness and response, tells Dark Reading these incidents may impact the incident response industry to some degree going forward.

“I think these incidents are likely to put additional pressure on ransomware negotiation firms to strengthen their background check processes,” he says. “These firms will likely also face greater scrutiny from the insurance industry, including the insurers that back ransomware negotiation firms.”

Court records indicate Dubrovsky was represented by the Federal Defenders office during his initial appearance. Dark Reading could not reach Dubrovsky for comment.