intelligence_src_f9879f264b7a8ec1d7
- Source-provided label
- Publisher RSS metadata
- Evidence class
- mentioned in report
- Confidence
- Not reported
- Observed
- Oct 10, 2026 16:20 UTC
- Retrieved
- Oct 13, 2026 05:17 UTC
<p>A Canadian cybersecurity executive who built a career helping organizations recover from cyberattacks has been arrested on federal extortion charges, a case that may be linked to the FBI&rsquo;s pursuit of the ShinyHunters hacking group that pilfered troves of bureau employee data.&nbsp;</p> Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. <p>Edward &ldquo;Ed&rdquo; Dubrovsky, 54, faces charges of conspiring to extort money by threatening to disclose stolen or hacked information and interfering with interstate commerce through extortion, according to<a href=“https://www.courtlistener.com/docket/74942095/united-states-v-dobrovsky/”> court records</a>. He appeared Thursday in federal court in Philadelphia, where a magistrate judge ordered him transferred to the Eastern District of Texas. Prosecutors are <a href=“https://storage.courtlistener.com/recap/gov.uscourts.paed.663480/gov.uscourts.paed.663480.3.0.pdf”>seeking his detention</a> pending trial.</p> <p><a href=“FBI Arrests Founder of Ransomware Negotiation Firm – Krebs on Security”>KrebsOnSecurity first identified Dubrovsky</a> on Friday night, citing sources linking his arrest to the ShinyHunters investigation. The New York Times had earlier reported that an unnamed Canadian man arrested in Pennsylvania was suspected of assisting the group, which claimed responsibility for a September breach exposing sensitive information about FBI employees.&nbsp;</p> <p>The complaint detailing the allegations against Dubrovsky remains sealed. His specific alleged conduct, including any role in the FBI intrusion linked to ShinyHunters, has not been publicly established.</p> <p>The arrest brings scrutiny to an executive whose professional reputation rested on helping victims navigate cyber incidents. Dubrovsky held leadership positions at incident-response companies, taught cybersecurity courses and recently published a book about how organizations should handle extortion incidents.&nbsp;</p> <p>He<a href=“Cyber Security Just Got Stronger As Iconic Operator Ed Dubrovsky Joins CYPFER”> joined CYPFER in 2022</a> to lead consulting and threat intelligence operations and later served as its chief operating officer and managing partner. The company&rsquo;s announcement described him as a veteran of three decades in cybersecurity and technology who had helped thousands of organizations recover from attacks and advised executives, lawyers and insurance carriers.&nbsp;</p> <p>Before that, Dubrovsky headed cyber breach response at Cytelligence, which Aon acquired in 2020. A<a href=“https://continue.yorku.ca/event/cyber-webi-s21-ondemand/”> York University biography</a> identified him as Cytelligence&rsquo;s chief operating officer and Aon&rsquo;s Canadian cyber leader. He also taught courses in cybersecurity engineering and security assessment and testing.&nbsp;</p> <p>More recently, Dubrovsky publicly promoted his work with CyberSteward, including ransomware negotiations and extortion advisory services. In a<a href=“https://ca.linkedin.com/in/edubrovs”> LinkedIn post</a> ahead of the NetDiligence Cyber Risk Summit in Philadelphia this month, he said he planned to attend with the company&rsquo;s team.&nbsp;</p> <p>FBI Director Kash Patel announced Friday that the bureau had <a href=“FBI arrests another ShinyHunters suspect after massive breach of employee data - Nextgov/FCW”>arrested</a> another suspected ShinyHunters co-conspirator, without naming the person or disclosing charges. Canadia
33b841dd47a9ef47efea809a10e0f9f4848761e8819f1724acc4b5e378862261Network indicators are visibly defanged. This page does not make them clickable or send them to another service.
No validated file hashes or network indicators are stored for this record.
This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.