FBI Arrests CyberExtortion Advisor in ShinyHunters Probe
Federal Bureau of Investigation agents arrested Edward Dubrovsky, a Canadian cybersecurity professional and co-founder of the firm CyberSteward, in Pennsylvania on Thursday, October 8, 2026. The arrest was made in connection with an ongoing investigation into the ShinyHunters hacking group, which has been linked to the theft of sensitive FBI data and extensive extortion campaigns targeting organizations worldwide.
According to sources close to the investigation, Dubrovsky was visiting Pennsylvania to attend the Cyber Risk Summit held at the Loews Philadelphia Hotel from October 5 to October 7, 2026. His company, CyberSteward, specializes in ransomware negotiation and extortion advisory services, a focus that aligns with the allegations against him.
Charges and Court Proceedings
Federal court records indicate that Dubrovsky was charged with "conspiracy to threaten to impair the confidentiality of information with the intent to extort money" and "interference with commerce by threats." The core complaint in the case has been sealed, but a summary indexed by CourtListener.com confirms the nature of the charges. Initially filed in Pennsylvania, the case was transferred to the Eastern District of Texas on October 9, 2026, a move sources say reflects the centralization of the ShinyHunters investigation at an FBI field office in Texas.
Dubrovsky, who is 54 years old, is currently being held at a federal detention facility in Philadelphia, according to the U.S. Bureau of Prisons inmate locator. As of the latest available information, he has not retained legal counsel and has not been appointed a public defender.
Background on the Accused and His Firm
Edward Dubrovsky is listed on LinkedIn as the co-founder of CyberSteward, a Canadian cybersecurity firm that provides services in ransomware negotiation, extortion response, and strategic advisory. He is also the author of a 252-page book titled "Cyber Extortion Strategic Response," which outlines frameworks for engaging with cybercriminals without committing to payment. An excerpt from the book’s Amazon listing states: "At the heart of the book is a critical distinction: communicating with a criminal is not the same as negotiating a payment, and negotiating is not a commitment to pay."
Prior to founding CyberSteward, Dubrovsky was associated with Cypfer, a Canadian security company that sponsored the Cyber Risk Summit where he was detained. His LinkedIn profile shows he had planned to attend the summit with the CyberSteward team approximately one month before his arrest.
Connection to ShinyHunters and Broader Investigation
The ShinyHunters group is known for using phishing and stolen credentials to infiltrate software-as-a-service (SaaS) platforms, exfiltrate sensitive data, and threaten public disclosure unless a ransom is paid. The FBI has attributed more than $70 million in extortion payments to ShinyHunters so far in 2026.
Investigators have been examining devices seized during the arrest of Pepijn van der Stap, a convicted cybercriminal detained by Dutch police last month in connection with ShinyHunters. Following van der Stap’s arrest, a ShinyHunters member known as "Rey" — identified as teenager Saif Al-din Khader — assumed leadership of the group and reportedly taunted the FBI after stealing data from the agency’s online recruitment portal, including personnel specializations and medical records.
Rey was later detained and has been cooperating with FBI investigators, as reported by Reuters. Earlier in October, KrebsOnSecurity detailed how Rey was apprehended while allegedly attempting to extort a navigation and digital aviation unit previously divested by Boeing.
Authorities indicate that additional charges against individuals or firms involved in ransomware negotiation may be forthcoming as the investigation continues. The case remains active, with updates expected as new developments emerge.
Source: Krebs on Security