On October 8, 2026, FBI arrested Edward Dubrovsky, a cybersecurity executive, who held himself out as an expert involved in cyber ransom negotiations and settlement services, on federal extortion charges. Dubrovsky’s arrest follows a series of recent federal prosecutions, which illustrate the moral gray zone in which these negotiators operate as well as signal law enforcement’s willingness to scrutinize cybersecurity professionals who engage with criminals participating in cyber extortion. Increasingly, law enforcement is examining whether those professionals are actually assisting threat actors, while representing that they are assisting victims. These prosecutions demonstrate the significant risks posed when engaging with this criminal ecosystem. Dubrovsky was reportedly charged in connection with the FBI’s sweeping crackdown on the cybercriminal syndicate known as ShinyHunters. In late September, ShinyHunters hacked the FBI recruitment website fbijobs.gov and threatened to publish certain stolen files, which reportedly included medical and psychological records, social security numbers, home addresses, and information about each employee’s unit and specialization. While further details regarding Dubrovsky’s specific conduct will be revealed when the case proceeds, it is important to note that Dubrovsky is not the only ransomware remediation cybersecurity professional who has recently faced criminal liability. On October 7, 2026, the day before Dubrovsky’s arrest, Zohar Pinhasi was arraigned in the Eastern District of New York and was charged with federal fraud charges. According to the indictment, Pinhasi held his company, MonsterCloud, out as a ransomware remediation company with the ability to recover data encrypted by ransomware. Pinhasi allegedly discouraged prospective clients from making ransomware payments to hackers, while secretly paying the cybercriminals who victimized MonsterCloud’s clients in exchange for decryption keys. Pinhasi then charged MonsterCloud’s clients a fee that was substantially higher than the ransom MonsterCloud had already paid. In total, MonsterCloud and Pinhasi allegedly charged hundreds of clients more than $19 million for their services and paid more than $8 million to cybercriminals in ransom payments.As another example, Angelo Martino, a ransomware negotiator, pleaded guilty to conspiring with two other cybersecurity professionals to deploy ransomware known as ALPHV BlackCat against multiple victims throughout the United States. Martino and his co-conspirators then agreed to pay ALPHV BlackCat administrators a 20% share of any ransoms received in exchange for access to the ransomware and ALPHV BlackCat’s extortion platform. In July 2026, Martino was sentenced to 70 months in prison, and his two co-conspirators were sentenced to 48 months each in May 2026.Ransomware negotiators can provide a critical resource to companies facing cyber extortion, including by buying additional time for incident responders and helping gather additional intelligence regarding the scope of a data incident. However, these negotiators directly interact with an underground economy that, by the estimate of one crypto analysis company, generated over $820 million in ransom payments in 2025, which can motivate bad behavior. These recent enforcement actions send a clear message that DOJ and the FBI are looking closely at the conduct of those professionals and will not hesitate to investigate faithless employees and their companies that help support the growing underground digital extortion ecosystem. Takeaways:Direct dealings with threat actors may create risk for cybersecurity firms if their employees cross the line from representing the victim to assisting the threat actor. The role of a cybersecurity and incident response professional provides access to sensitive and confidential information that can be misused and misappropriated. Cybersecurity firms should ensure that their employees remain within the scope of the client engagement and avoid taking steps that may be construed as facilitating or supporting the threat actor’s criminal activities.Misrepresenting what a cybersecurity firm is actually doing can create criminal fraud exposure. Lack of transparency about the cybersecurity firm’s methods, any payments to threat actors, or the basis for certain charges to clients can risk transforming an incident response engagement into a basis for a DOJ enforcement action.DOJ may scrutinize the role ransomware remediation cybersecurity professionals have in a cybercrime case. For cybersecurity firms operating in this space, interactions with threat actors may be subject to heightened scrutiny when law enforcement is investigating the broader criminal network. From a controls perspective, companies operating in that ecosystem should implement and enforce a policy that all communications with threat actors be preserved, and cybersecurity firms should consider engaging with regulators early if there is suspected misconduct.Cybersecurity firms may face significant investigative and reputational consequences from an individual responder’s conduct, even if that conduct is not ultimately attributed to the firm itself. Misconduct by one employee with confidential client information and direct access to threat actors risks drawing the firm into a DOJ investigation or no longer being viewed as a reputable partner to provide these services. Cybersecurity firms should consider their internal policies and guardrails around employee conduct to ensure their business remains viable, even if an investigation or enforcement action is not brought against the company itself.To receive the latest insights on US legal developments, subscribe to the Freshfields A Fresh Take Blog.
——————————————————–
Click Here For The Original Source.
