"The group has extorted more than $70 million from victims so far this year," the FBI told reporters — a stark figure at the center of a rapidly moving criminal probe that has touched U.S. law enforcement, European police and the private firms that advise victims of ransomware.
The arrest in Pennsylvania: names, charges and status
Federal court records show that on October 8 a man listed as Edward Dobrovsky (a slight misspelling of the last name) was arrested in Pennsylvania on charges that include "conspiracy to threaten to impair the confidentiality of information with the intent to extort money" and "interference with commerce by threats." Several core documents in the case remain sealed, though a handful of filings — including a summary of the complaint — were indexed at CourtListener.com.
The inmate locator at the U.S. Bureau of Prisons lists a 54‑year‑old Edward Dubrovsky as being held at a federal facility in Philadelphia. A notice filed on October 9 moved the case to the Eastern District of Texas, which sources tell KrebsOnSecurity has become the hub for the ShinyHunters investigation. The available court records also show the defendant does not currently have an attorney and has yet to be appointed a public defender.
Connections to ransomware negotiation firms and a Philadelphia conference
Sources told KrebsOnSecurity the arrested man is associated with a Canadian cybersecurity company that specializes in handling ransomware negotiations with criminal groups. An online search shows the Cyber Risk Summit took place at the Loews Philadelphia Hotel between October 5 and October 7; the summit’s website lists a Canadian security company called Cypfer as the event’s biggest sponsor.
LinkedIn listings tie the name Edward Dubrovsky to a Canadian firm called CyberSteward and describe him as an author of a book titled Cyber Extortion Strategic Response. In a LinkedIn post about a month before the summit, Dubrovsky wrote he was "Looking forward to continuing conversations around strategy & compliant driven coercive (ransomware, extortion) advisory, negotiations and settlement services that are global and truly agnostic." KrebsOnSecurity later noted, in an update on October 10, that a spokesperson for Cypfer said Dubrovsky was not a founder or co‑founder as his LinkedIn profile claims but instead served as a managing director before resigning in November 2025.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildHow the ShinyHunters probe has unfolded in recent weeks
Sources tell KrebsOnSecurity the FBI has been analyzing devices seized last month by Dutch police when they arrested the convicted cybercriminal Pepijn van der Stap in connection with the ShinyHunters investigation. After van der Stap’s arrest, another member known as "Rey" allegedly assumed control of the group and publicly taunted the FBI over data taken from the agency's online recruitment portal — data that reportedly included each person’s unit and specialization as well as medical and psychiatric records.
Reuters reported that "Rey" has been identified as a teenager named Saif Al‑din Khader, who was detained and is cooperating with FBI investigators. KrebsOnSecurity also detailed on October 7 that Rey was apprehended as the group allegedly sought to extort a navigation and digital aviation unit that had been divested by Boeing in late 2025. Sources say additional charges against principals at other companies that specialize in ransomware negotiation may be forthcoming.
What this means for the FBI, ransomware‑negotiation firms, and affected aviation units
- The FBI: The agency has centralized control of the ShinyHunters probe at a Texas field office and has publicly quantified ShinyHunters' impact — "more than $70 million" extorted this year — while declining further comment for this story. A statement on Twitter/X from FBI Director Kash Patel about the arrest did not identify the man.
- Ransomware‑negotiation firms and advisers: The arrest of an executive who publicly described advising on "coercive (ransomware, extortion) advisory" and authored a 252‑page book on ransomware negotiations underscores that individuals who mediate between victims and criminals are now within the scope of criminal investigations.
- Affected aviation and corporate units: The alleged attempt to extort a navigation and digital aviation unit divested by Boeing, and the broader pattern of ShinyHunters siphoning data from software‑as‑a‑service accounts, indicate that commercial organizations and divested business units remain high‑value targets for extortion campaigns.
The case appears to be moving quickly: court filings were sealed even as indices surfaced, a detention was logged in Philadelphia and the matter was transferred to the Eastern District of Texas within 48 hours of the arrest notice. Investigators are also working through devices seized in Europe and following leads that may implicate other principals in the business of negotiating with ransomware groups. The FBI declined to provide further comment; KrebsOnSecurity said it sought comment from CyberSteward's other co‑founder and will update if they respond.
Original reporting: https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/
