Prominent Ransomware Negotiator Faces Extortion Charges

Cypfer's Edward Dubrovsky Formally Charged With Conspiracy to Extort

Edward Dubrovsky, 54, one of the ransomware-negotiation industry's most recognized voices, has been formally charged with federal extortion-related offenses, according to court records reviewed by DarkReading, BleepingComputer, and KrebsOnSecurity. Dubrovsky — a Canadian national tied to the incident-response firm Cypfer and the advisory brand CyberSteward — was arrested on October 8, 2026, in the Philadelphia area while attending the NetDiligence Cyber Risk Summit, a cyber-insurance industry conference at which Cypfer was the lead sponsor.

He appeared in federal court in the Eastern District of Pennsylvania the same day. A judge ordered him detained, and a separate order directed the US Marshals Service to transport him to Texas, where the case was transferred on October 9 to the Eastern District of Texas — a venue multiple outlets report now serves as the operational hub of the FBI's investigation into the ShinyHunters extortion group. CosmicBytez Labs first reported Dubrovsky's arrest on October 9; this follow-up covers the formal charges filed since then and the wider pattern now emerging across the negotiation industry.

The charging documents, part of a complaint that remains sealed, list two federal violations: conspiracy to threaten to impair the confidentiality of information with intent to extort money under the Computer Fraud and Abuse Act (18 U.S.C. §§ 371, 1030(a)(7)(B)), and interference with commerce by threats — commonly known as Hobbs Act extortion (18 U.S.C. § 1951(a), (b)(2)). Because the underlying complaint is sealed, the specific conduct prosecutors allege has not been made public. Dubrovsky remains in federal custody, reportedly at the Federal Detention Center in Philadelphia, according to the Bureau of Prisons' inmate locator. No conviction has occurred, and the allegations remain unproven.

Case Details

Background on the Alleged Scheme

How Ransomware Negotiation Is Supposed to Work

Firms like Cypfer exist to represent victims, not attackers. A legitimate negotiator's job is to open a communication channel with a ransomware gang, verify the scope of a breach, buy the client time to assess backups and legal exposure, and — where a payment is unavoidable — push the demand as low as possible while documenting the process for insurers, regulators, and law enforcement. The position is inherently sensitive: a negotiator typically has full visibility into a victim's backup posture, cyber-insurance limits, legal strategy, and willingness to pay — all information an attacker would otherwise have to guess at.

A Disputed Résumé

Dubrovsky's LinkedIn profile described him as a co-founder of Cypfer, and press coverage initially repeated that framing. A Cypfer spokesperson told KrebsOnSecurity, however, that Dubrovsky was never a founder or co-founder, but instead served as Managing Director before resigning in November 2025 — roughly 11 months before his arrest. Politico has separately reported that CyberSteward is a trade name used by Cypfer, with both brands marketing ransomware-negotiation and cyber-extortion-response services. The discrepancy over his title is a minor detail on its face, but it matters for a case built around whether a negotiator misused the trust and access his role afforded him.

Beyond the firm itself, Dubrovsky had cultivated a public profile as a subject-matter expert: he was a regular source for outlets including DarkReading, sat on InfraGard panels at the RSA Conference in April 2025 alongside FBI San Francisco cyber-branch agents, and had recently self-published a guidebook, "Cyber Extortion Strategic Response," on best practices for handling ransom demands.

The ShinyHunters Thread

None of the publicly filed documents explicitly tie Dubrovsky's case to a specific incident. However, FBI Director Kash Patel posted on X the day after the arrest that the bureau had "arrested another suspected co-conspirator of the ShinyHunters group" — the actor blamed for the September 2026 breach of FBIjobs.gov, which exposed sensitive data on more than 5,000 FBI personnel and applicants after a third-party-managed platform went unpatched. Patel did not name the suspect, and authorities have not publicly confirmed Dubrovsky is the individual referenced. Dubrovsky's arrest follows two other ShinyHunters-linked detentions reported in recent weeks: Pepijn van der Stap ("Umbreon"), arrested by Dutch police in Amsterdam on September 29, and a Jordanian teenager known as Saif al-Din Khader ("Rey"), reported to be cooperating with the FBI.

Not an Isolated Case

Dubrovsky's arrest lands amid a string of prosecutions involving ransomware-negotiation professionals in 2026, raising questions about oversight of an industry that operates with minimal licensing or regulation. Zohar Pinhasi was separately charged with wire fraud for allegedly paying ransomware criminals in secret while overbilling clients for the same payments. Angelo Martino, 41, of Land O'Lakes, Florida, pleaded guilty to extortion after prosecutors found he had fed confidential client negotiating positions to the BlackCat/ALPHV ransomware group beginning in April 2023, abusing his access at a US-based incident-response firm; he and co-defendants faced a maximum sentence of 20 years. Taken together, the cases describe a recurring failure mode: the same proximity to extortion gangs that makes a negotiator useful to victims also gives a dishonest one the means and opportunity to work both sides of the table.

Impact Assessment

Recommendations

For Organizations Hiring Incident-Response / Negotiation Firms

• Treat the selection of a ransomware-negotiation vendor with the same diligence applied to any party gaining breach-time access to sensitive data — verify ownership structure, affiliated trade names, and any history of regulatory or criminal action.
• Request contractual guarantees around how negotiation data (backup status, insurance limits, payment authority) is stored, who can access it, and how long it is retained after an engagement closes.
• Ask prospective vendors directly whether any current principal has been named in litigation or a criminal proceeding tied to ransomware or extortion.

For Security Teams

• Build a pre-vetted shortlist of incident-response and negotiation firms before an incident occurs; a crisis is the worst time to perform vendor due diligence for the first time.
• Compartmentalize what a negotiator is told — share only what is operationally necessary to conduct talks, rather than full visibility into insurance limits or maximum willingness to pay.
• Log all negotiator communications and payment recommendations independently, so a victim organization retains its own record rather than relying solely on the vendor's account.

For Legal / Procurement

• Add conflict-of-interest attestations and right-to-audit clauses to incident-response and negotiation retainer agreements.
• Confirm cyber-insurance panel vendors are vetted independently by the insurer, not merely listed because of a sponsorship or referral relationship.
• Track regulatory developments — a licensing or registration regime for ransom-payment facilitators is increasingly plausible given the frequency of these cases.

Key Takeaways

1. Edward Dubrovsky, 54, faces conspiracy-to-extort and Hobbs Act charges following his October 8 arrest in Pennsylvania; the case has moved to the Eastern District of Texas, and the underlying complaint remains sealed.
2. His firm, Cypfer, disputes his "founder" title, telling KrebsOnSecurity he was a Managing Director who resigned in November 2025 — a discrepancy that matters given the case centers on alleged misuse of a trusted role.
3. A possible, unconfirmed link to the FBI's ShinyHunters investigation follows public statements from FBI Director Kash Patel, though authorities have not named Dubrovsky directly.
4. This is the third notable ransomware-negotiator prosecution in roughly a year, alongside Zohar Pinhasi's wire-fraud charges and Angelo Martino's guilty plea for aiding the BlackCat/ALPHV group — a pattern that undercuts trust in an unlicensed industry.
5. No conviction has occurred; all allegations against Dubrovsky are unproven, and the sealed complaint means specifics of the alleged scheme are not yet public.
6. Organizations should treat negotiation-firm selection as a supply-chain risk decision, applying the same vetting rigor used for any vendor with breach-time access to sensitive operational and financial data.

Sources

• DarkReading — Prominent Ransomware Negotiator Faces Extortion Charges
• BleepingComputer — Cyber exec arrested in case allegedly tied to ShinyHunters hackers
• KrebsOnSecurity — FBI Arrests Founder of Ransomware Negotiation Firm

Related Reading

• FBI Arrests Ransomware Negotiation Firm Co-Founder in ShinyHunters Probe