An Executive at a Ransomware Negotiation Firm Was Arrested in the ShinyHunters Probe: How to Vet the Incident Response Firms You’d Call on Your Worst Day

Most companies sign an incident response retainer once, file it, and never look at it again. That retainer names the people who would see your most sensitive data, talk to your attackers, and possibly move your money on the worst day your company has. This week’s news is a good prompt to treat ransomware negotiation firm vetting incident response planning as a trust decision you revisit, not a box you checked once.

What Was Reported, and What Is Confirmed

On October 9, FBI Director Kash Patel announced that agents had arrested “another suspected co-conspirator of the ShinyHunters group,” as BleepingComputer reported. Patel did not name the suspect. ShinyHunters is the extortion group the FBI holds responsible for the September breach of its jobs portal.

KrebsOnSecurity reported that the FBI arrested “an executive at a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group,” citing multiple sources. Press reports identify the man reportedly arrested as Edward Dubrovsky, 54. The FBI has not publicly confirmed that he is the person Patel described. BleepingComputer says plainly: “While the FBI has not publicly confirmed that Dubrovsky is the suspected ShinyHunters co-conspirator, KrebsOnSecurity reports that multiple sources linked Dubrovsky’s arrest to the ShinyHunters investigation.”

The court record is more concrete, and it spells the name differently. A federal docket indexed on CourtListener, United States v. Dobrovsky in the Eastern District of Pennsylvania, shows an arrest on October 8. It lists the complaint charges as:

• “CONSPIRACY TO THREATEN TO IMPAIR THE CONFIDENTIALITY OF INFORMATION WITH THE INTENT TO EXTORT MONEY”
• “INTERFERENCE WITH COMMERCE BY THREATS (HOBBS ACT EXTORTION AND CONSPIRACY TO COMMIT HOBBS ACT EXTORTION)”

A commitment order dated October 9 sends the defendant to the Eastern District of Texas, where the charges were filed. The complaint itself is sealed. BleepingComputer notes that “it is still unclear what he is accused of doing or whether the case is connected to the FBI breach.”

These are allegations. Dubrovsky has not been convicted of anything, and he is presumed innocent. Prosecutors have not said the charges involve his negotiation work, and I am not suggesting they do.

What the Firms Say

Descriptions of his role vary, so here is what each source says. KrebsOnSecurity reported that LinkedIn listed him as one of CYPFER’s “ex-founders,” and that he is “now associated with another Canadian security firm and sponsor called CyberSteward.” CyberScoop describes CYPFER as “a firm that helps organizations negotiate with ransomware operators,” and CyberSteward as “a Toronto-based firm that helps breach victims negotiate ransom payments.”

CYPFER disputes the founder label. A firm representing CYPFER told CyberScoop that his role “was Managing Director from May 2022 through Dec. 2025,” and that he “had no affiliation, operational role or relationship with CYPFER since that time, and contrary to certain reporting, was never a founder or co-founder of the company.” I found no published statement from CyberSteward.

Did he do negotiation work himself? The sources point that way without proving it. Krebs quotes a LinkedIn post in which he wrote of “advisory, negotiations and settlement services,” and one of Krebs’s sources said “the suspect’s company specialized in handling ransomware negotiations with cybercrime groups.” He also recently published a book, Cyber Extortion Strategic Response, about handling cyber extortion.

One more line from Krebs is the reason this matters beyond one case. Sources told KrebsOnSecurity that “charges against principals at other companies that specialize in ransomware negotiation may be forthcoming.” That is unconfirmed, and I would treat it that way.

Why an IR Retainer Is a Trust Relationship

From here on, this is my opinion and my own recommendation, not something any source above prescribes.

Think about what you hand an incident response or negotiation firm during a crisis. You give them access to your environment, your stolen data samples, your executives’ phone numbers, your insurer, and sometimes your payment process. You give them direct contact with the people extorting you. Few vendors get that much trust that fast, and most companies picked theirs from an insurer’s panel list years ago.

Picture this hypothetical. Your company is hit, you call the firm on your retainer, and the negotiator assigned to you works through a channel nobody on your side can see. If that person, or anyone at the firm, were ever compromised or conflicted, you would have little way to know. Nothing in this week’s case shows that happened to any client. The point is that most retainers are not built to detect it if it ever did.

My Ransomware Negotiation Firm Vetting Checklist for Incident Response

This is what I would do, and it is my recommendation only:

1. Re-vet the firm every year, not just at signing. Confirm who owns it, who runs it, and whether anything has changed. Check the names on the retainer against current news and court records.
2. Know the individuals, not just the logo. Ask which people would actually work your case and negotiate, and what background checks the firm runs on them.
3. Ask how they prevent conflicts of interest. Ask whether they have policies against staff having any relationship with threat actors beyond case communication, and how they enforce them.
4. Keep visibility into every attacker conversation. Require that all negotiation messages be logged and shared with your counsel and your internal lead, with no side channels.
5. Split the money from the talking. Any payment decision and movement of funds should need approval from your own executives and counsel, with documented checks, not just the negotiator’s word.
6. Have a second option ready. Keep an alternate firm pre-approved with your insurer, so you are not stuck with one vendor if you lose trust mid-incident.
7. Put audit rights in the contract. Ask for the right to review case records, data handling, and staff access after an incident closes.

The Bottom Line

One sealed complaint does not tell us what happened, and the person charged has not been convicted. What it does is remind us that the vendors we would call on our worst day deserve the same scrutiny we give any other privileged access. Review that retainer before you need it.