Fraud Management & Cybercrime
,
Ransomware
Man Charged With Cyber Conspiracy and Extortion as FBI Investigates ShinyHunters
A Canadian ransomware negotiation expert has been named as a suspect recently arrested as part of the FBI’s crackdown on the ShinyHunters cyberextortion group.
See Also: The IT Visibility Gaps Putting Manufacturing Operations at Risk
Multiple press reports point to Edward Dobrovsky being the accused ShinyHunters co-conspirator arrested last week as the FBI responds to the group’s theft of personal data pertaining to the law enforcement agency’s employees.
Dobrovsky has been charged with conspiracy to “threaten to impair the confidentiality of information with intent to extort money” and “interference with commerce by threats,” according to court documents.
He made his first U.S. District Court appearance in Philadelphia on Thursday. The U.S. Bureau of Prisons inmate locator on Monday reported Dobrovsky, 54, was incarcerated at an administrative security federal detention center in Philadelphia.
Dobrovsky’s arrest, although not his name, was first reported Friday by The New York Times.
Although based in the Toronto area, Dobrovsky was arrested last week on cyber conspiracy and extortion charges in the Philadelphia area, where he was apparently attending a cyber insurance conference, reported cybersecurity journalist Brian Krebs on Friday.
The conference included among its sponsors Canadian incident response firm Cypfer, for which Dobrovsky’s LinkedIn profile says he was a founder and its chief operating officer until January. The firm told Krebs that Dobrovsky served as its managing director until he stepped down in November 2025.
FBI Director Kash Patel appears to have referenced his arrest in a Friday post to social platform X, without naming the suspect.
“Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group – the group believed to be responsible for the recent FBIjobs.gov incident, which occurred on a platform managed by a third-party vendor,” Patel wrote.
“This is the latest arrest this FBI has made in a matter of days involving this network, as we work non-stop to dismantle the group, pursue new leads and evidence and act quickly,” he said.
Dobrovsky couldn’t be immediately reached for comment. He appears to have extensive experience in helping organizations respond to ransomware incidents, and to now work with a Toronto-based cybersecurity firm called CyberSteward. “As an expert in the cybersecurity incident response space I have managed, negotiated and contained over 11,000 incidents with over 7,500 negotiations helping companies and clients get to safety,” his LinkedIn profile reads.
He’s also the author of an independently published book, available from Amazon, called “Cyber Extortion: Strategic Response.”
U.S. Magistrate Judge Scott W. Reid on Friday ordered the U.S. Marshals Service to relocate the defendant to Texas, where the FBI investigation into ShinyHunters is being led, Krebs reported.
Other suspected ShinyHunters members recently arrested or detained have included Jordanian Saif al-Din Khader, 16, as well as Pepijn van der Stap, 24.
The bureau has been on the defensive since ShinyHunters claimed to have stolen extensive amounts of data on FBI employees. The cybercrime collective claimed to have exploited a vulnerability in the FBI’s Oracle PeopleSoft software, then pivoted to its Amazon Web Services GovCloud environment to steal over two terabytes of data (see: Cyber Extortion Group Claims: ‘We Have Compromised the FBI’).
The FBI subsequently reportedly removed an Accenture contractor for failing to patch a major enterprise system used by the law enforcement agency, which multiple reports suggest was its PeopleSoft system.
Dobrovsky isn’t the only incident response executive in recent weeks to face criminal charges tied to ransomware. A federal grand jury last month indicted Zohar Pinhasi, 50, for defrauding ransomware victims by claiming to recover their data using silver-bullet technical capabilities. Prosectors allege that Pinhasi, who ran Florida-based MonsterCloud, typically resorted to just paying a ransom, then charging his clients a multiple of that amount (see: Ransomware Response Firm CEO Accused of Data Recovery Fraud).
Click Here For The Original Source.
