“Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group – the group believed to be responsible for the recent FBIjobs.gov incident, which occurred on a platform managed by a third‑party vendor,” FBI director Kash Patel wrote on X on October 9, confirming an arrest that court papers later identify by name.
The arrested individual: Edward Dubrovsky
Court documents name the person taken into custody as Edward Dubrovsky, a 54‑year‑old Canadian cybersecurity executive based in Toronto. The FBI has charged Dubrovsky with “conspiracy to threaten to impair the confidentiality of information with intent to extort money,” and “interference with commerce by threats.” The agency’s public post did not name the individual; the director’s statement described the arrest only as “another suspected co‑conspirator.”
Dubrovsky’s professional profile and public work
Public records cited in reporting link Dubrovsky to a series of private‑sector roles. He is described as a former managing director at incident response firm Cypfer and as currently associated with cyber‑consulting firm CyberSteward. He is also the author of a book titled Cyber Extortion Strategic Response, which is marketed as a “practical manual for leaders on managing coercive events, negotiation and settlement strategies.” Reporters characterize him as appearing to be a self‑styled expert in negotiating with cyber extortionists.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildShinyHunters, previous arrests, and the FBIjobs.gov breach
Dubrovsky’s arrest is the latest in a string of detentions tied to the ShinyHunters group. Dutch police earlier arrested Pepijn van der Stap in connection with the same incident. On September 29, Jordanian authorities detained a 17‑year‑old identified as Saif Al‑din Khader (aka Rey); reporting says Khader is cooperating with the FBI’s investigation.
According to published accounts, ShinyHunters exploited a vulnerability in Oracle PeopleSoft to compromise the FBI’s jobs site, FBIjobs.gov, then pivoted to AWS GovCloud servers and extracted an estimated 2–3TB of data. Those reports say the exfiltrated data may include names, addresses, telephone numbers, dates of birth, social security numbers and emergency contact details for thousands of FBI employees, including individuals in counter‑intelligence roles.
Technical vector and the role of a third‑party contractor
The director’s statement and subsequent reporting stress that the FBIjobs.gov incident “occurred on a platform managed by a third‑party vendor.” It has been reported that an Accenture contractor was removed from bureau work after failing to patch the PeopleSoft vulnerability that ShinyHunters allegedly exploited. The sequence described in reporting — PeopleSoft compromise followed by lateral movement to AWS GovCloud and large‑scale data extraction — frames the incident as both an application‑level vulnerability and a cloud‑hosted data‑exfiltration problem.
How technologists, policymakers, and affected employees are positioned
- Technologists and security teams: Security teams responsible for PeopleSoft deployments and GovCloud environments will be watching patch management and third‑party vendor controls closely; the reported chain of events highlights the need to bridge application‑level fixes with cloud access controls.
- Policymakers and regulators: Officials overseeing federal procurement and contractor oversight may focus on accountability for patching and vendor performance after reporting that an Accenture contractor was removed for failing to patch the exploited vulnerability.
- Affected FBI employees: Thousands of employees are reported to be potentially impacted by the data extracts — including names, contact details, dates of birth and social security numbers — and will look to the FBI for notifications, protections and details about the scope of exposure.
The FBI director said the arrest is “the latest” in a series of actions as the bureau works “non‑stop to dismantle the group, pursue new leads and evidence, and act quickly.” With multiple arrests already reported in the weeks following the breach and court papers now naming a Canadian executive, the next public evidentiary steps will likely unfold in filings and court proceedings. One concrete question remains: will court filings and the FBI’s ongoing investigation make public the operational links between the named suspects, the mechanics of the PeopleSoft exploit, and any contractual or advisory relationships that may have intersected with the bureau’s third‑party vendor?
Source: https://www.infosecurity-magazine.com/news/net-closes-shinyhunters-another/
