FBI Arrests Ransomware Negotiator; Case Heads to East Texas

FBI agents arrested Edward Dubrovsky, 54, a Canadian ransomware-negotiation executive, in Pennsylvania on October 8, 2026. KrebsOnSecurity and BleepingComputer report he was in town for the NetDiligence Cyber Risk Summit. Public records spell the caption United States v. DOBROVSKY.

This is a criminal case, not a company-notice breach. The E.D. Pennsylvania magistrate docket — 2:26-mj-01973, filed October 8 — lists conspiracy and extortion charges. The core complaint is sealed. A later order, cited by Krebs and BleepingComputer, moved the case toward the Eastern District of Texas. Krebs’s sources say the FBI’s ShinyHunters investigation is now run from a Texas field office. CourtListener does not yet show a separate ED Texas case number.

FBI Director Kash Patel said agents arrested “another suspected co-conspirator of the ShinyHunters group.” He did not name Dubrovsky. Multiple press sources have tied the arrest to that announcement and to the recent FBI jobs-portal theft. The bureau declined to comment to Krebs. Treat the ShinyHunters / FBI-jobs link as sourced reporting, not a public charging document.

Snapshot

What the public docket says

BleepingComputer quotes the magistrate caption: conspiracy to threaten to impair the confidentiality of information with intent to extort money, plus Hobbs Act extortion and conspiracy. Krebs describes the same pair as “conspiracy to threaten to impair the confidentiality of information” and “interference with commerce by threats.”

He has not been convicted. Krebs said he had no lawyer on the indexed papers and had not yet been appointed a public defender. Later press said a magistrate in Philadelphia appointed a federal public defender. We are not filling gaps from the sealed complaint.

The Bureau of Prisons inmate locator, Krebs wrote, showed a 54-year-old Edward Dubrovsky held in Philadelphia after the arrest.

CYPFER, CyberSteward, and the book

Dubrovsky’s public résumé sits in ransomware negotiation and “coercive” advisory. Krebs first called him a CYPFER “ex-founder.” A October 10 CYPFER update says he was a managing director who resigned in November 2025, not a founder. He has since been associated with CyberSteward, a Toronto advisory that markets threat-actor engagement, negotiations, and settlement facilitation.

CYPFER is a Canadian incident-response and ransomware-recovery firm (Toronto / Miami and other offices). Politico, as summarized by BleepingComputer, has described CyberSteward as a CYPFER trade name. CyberSteward’s own site presents a separate Toronto shop led by Jason S.T. Kotler. We do not treat that branding dispute as settled.

Dubrovsky’s book Cyber Extortion Strategic Response draws a line between talking to a criminal and paying a ransom. That is marketing copy, not a defense.

ShinyHunters — and what this is not

The FBI has said ShinyHunters-linked actors extorted more than $70 million this year (Krebs; BleepingComputer also cites 140+ organizations). The group’s public method is phishing and stolen SaaS credentials, then pay-or-leak. We already cover Texas-facing victim dumps such as Houston City College and Sysco. Those posts are not this arrest.

Do not treat a CYPFER or CyberSteward client as implicated. Do not treat every ransomware negotiator as charged. Krebs’s sources said other negotiation-firm principals may face charges. That is a lead, not a list.

What Texas orgs and IR buyers should do

1. Type fbi.gov and ic3.gov. Ignore “FBI jobs leak / pay to suppress your file” mail.
2. If you retain a negotiator, keep outside counsel on the engagement letter. Communicating with an actor is a legal-adjacent decision.
3. Confirm who is actually on the call. A familiar IR brand is not a warrant.
4. Employees: reset work passwords on a host you typed. ShinyHunters-style follow-on phishing spikes after FBI headlines.
5. Texas counsel watching the transfer: the magistrate row is still 2:26-mj-01973 until an ED Texas criminal number appears.

MFA: YubiKey and Google Authenticator

A hardware key does not decide a sealed extortion case. It does cut a lot of the “FBI portal / CYPFER invoice / CyberSteward retainer” phishing that follows this headline. Grades match our MFA directory.

Login.gov documents a security key and authenticator apps including Google Authenticator. cypfer.com and cybersteward.com are marketing sites. They publish no client-portal MFA help that names a YubiKey or Google Authenticator. Blog advice to “turn on 2FA” is not a graded enrollment path. MFA would not have stopped an in-person arrest.

Directory: MFA support directory · Category → Business Apps.

Recommended MFA tools

We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.

Independent cybersecurity audits

We audited the FBI, Krebs, CYPFER, and CyberSteward hosts on October 11, 2026. 100% is the ideal — none reach it. These scores are public email / transport / website posture. They do not prove or disprove the sealed complaint.

Audit links: fbi.gov · cypfer.com · cybersteward.com · krebsonsecurity.com

krebsonsecurity.com Identity 10% is the spoofing risk: a fake “Krebs update / sealed ED Texas exhibit” message is easier to land than the 32% overall implies. Krebs is the press host, not the defendant. CYPFER and CyberSteward Transport 15% means inbound IR mail can still be downgraded without MTA-STS enforce.

Website stack note

Passive website-tech probes on October 11, 2026:

Point-in-time only. A marketing homepage is not a forensic finding on the sealed complaint.

Blacklist and lookalike domains

Email blacklist checks (public DoH, October 11, 2026): fbi.gov, krebsonsecurity.com, cypfer.com, and cybersteward.com were clear on mail/domain lists we can query. Krebs has no MX in this probe; web/CDN Spamhaus ZEN / SPFBL / SpamRATS notes on that host, and CyberSteward SPFBL web notes, are informational — not mail-reputation hits.

DNS lookalike scans (BEC profile, registered signals only):

High-interest registered names (investigate; not proof this case used them):

cybersteward.co redirected to the real host when we checked. Type fbi.gov, cypfer.com, and cybersteward.com. Continuous monitoring: Cybersquat Domain Monitoring.

Related coverage

• Houston City College / ShinyHunters
• Sysco / ShinyHunters claim
• McKesson vishing / N.D. Tex. lawsuits
• FBI NCII lookalike support phishing
• Texas Cyber Command / Cyber Ready
• MFA support directory

Run a free audit at audit.emailmenow.com or contact EmailMeNow for DMARC / MTA-STS and phishing response aimed at the 100% ideal.