A Canada-based cybersecurity professional was arrested in the United States last week on suspicion of involvement with ShinyHunters, including the group's intrusion into FBI systems. According to SecurityWeek, FBI Director Kash Patel announced the arrest on a Friday. The Royal Canadian Mounted Police told CBS News it is aware that a Canadian was arrested in the US in connection with ShinyHunters.
Who was arrested, and what he faces
Authorities have not officially named the suspect. The New York Times and blogger Brian Krebs reported that he is Edward Dubrovsky, a Canadian who specializes in ransomware response. Court records, as described by SecurityWeek, spell the surname "Dobrovsky."
Per that account, he was arrested by the FBI after traveling to Philadelphia for a conference. He appears to be linked to CyberSteward, a Toronto-based firm that offers ransomware negotiation services. His LinkedIn profile reportedly lists executive roles at two North American cybersecurity companies, which are not named. He is also reportedly the author of Cyber Extortion: Strategic Response.
The court records show two charges:
- conspiracy to threaten to impair the confidentiality of information with intent to extort money;
- interference with commerce by threats.
The case has reportedly been moved to the Eastern District of Texas, where the FBI's ShinyHunters investigation is said to be run. Sources told Krebs that executives at other ransomware negotiation firms could also face charges in the case. That remains an unconfirmed claim.
Patel called this the latest arrest "in a matter of days" involving the network. He said the FBI is working to dismantle the group and pursue new leads, and will work with partners to disrupt "what's left" of ShinyHunters and its associates "no matter where they operate."
The FBI intrusion
ShinyHunters, an extortion group, claimed it had accessed the FBI's jobs website and other systems. It said it obtained information on nearly all agents and job applicants. Those are the group's assertions. It described the attack as retaliation for an FBI report, published earlier in the year, that warned organizations about ShinyHunters activity.
The FBI gave a different account of the entry point. It attributed the intrusion to a contractor's failure to patch vulnerable Oracle PeopleSoft software, according to SecurityWeek. The report names no CVE, affected version or patch.
The source describes the suspect's role in that intrusion only as suspected. It does not say what part he allegedly played.
Third arrest in recent weeks
SecurityWeek counts this as the third ShinyHunters-related arrest in recent weeks:
- September 15: an alleged key member was arrested in the Netherlands. Earlier coverage looked at the Dutch side of the probe.
- September 28: another alleged key member was reportedly arrested in Jordan and is reportedly cooperating with the FBI.
Group status
In late September, ShinyHunters reportedly said its operations and infrastructure were unaffected and urged victims to pay. Statements the group had addressed to the FBI and to victims were later removed from its Tor-based website. At the time of SecurityWeek's reporting, the site was reportedly no longer accessible.
Organizations running Oracle PeopleSoft, or relying on contractors that do, have a concrete takeaway from the FBI's explanation: confirm that patching on those systems is current, including at third parties.
