The FBI’s hunt for the ShinyHunters extortion group has put a spotlight on an unlikely corner of the security business – the people victims hire to deal with the extortionists.
FBI Director Kash Patel announced Oct. 9 that agents had arrested “another suspected co-conspirator of the ShinyHunters group,” which the bureau blames for the breach of its FBIjobs.gov hiring portal. He didn’t name the suspect. Reuters has since identified a man arrested in Pennsylvania on Oct. 8 as Edward Dubrovsky, a Canadian ransomware negotiator. Authorities have not said Dubrovsky is the suspect Patel described.
On Oct. 7, the owner of a Florida ransomware recovery firm was arraigned in Brooklyn on fraud charges. Prosecutors allege he secretly paid attackers while telling clients he didn’t have to.
The cases are unrelated, and no one has been convicted in either.
Hostage Negotiators Without a Badge
A ransomware negotiator’s job looks a lot like a hostage negotiator’s. They keep the captor talking, buy time, test whether they really have what they claim, and talk the price down. Along the way, the negotiator learns what was stolen, what the victim can afford and, sometimes, what its cyber insurance covers.
But a police negotiator answers to a chain of command. A ransomware negotiator answers to a contract, with no license or regulator behind the hire. The warning signs aren’t new. In 2019, ProPublica reported that recovery firms, MonsterCloud among them, were quietly paying attackers while telling victims otherwise.
Now prosecutors are paying attention. Five people from the ransomware response business have been charged in about a year, a corner of the industry that had rarely drawn criminal cases. That includes two incident responders sentenced in May for working with the BlackCat gang. It comes as victims are walking away from the table. Coveware, itself a negotiation firm, says the share of its clients who paid hit a new record low in the second quarter. Only 15% paid in data-theft-only cases. ShinyHunters ranked No. 2 in its caseload.
The Negotiator and the ShinyHunters Probe
The FBI has been hunting ShinyHunters since the extortion group claimed in September to have breached FBIjobs.gov, the bureau’s hiring portal. Dubrovsky’s arrest is the third publicly announced in that investigation, according to Reuters. In September, Dutch police detained a 24-year-old suspected of participating in the group, and Reuters later reported a 16-year-old was detained in Jordan. SPB is not naming him because he is a minor.
Court documents show Dubrovsky faces two federal counts. One, conspiracy to threaten to impair the confidentiality of information with intent to extort money, and interference with commerce. Reuters said the records spell his name “Dobrovsky” or “Dobrosky,” and a person briefed on the matter confirmed the defendant is Dubrovsky. The filings themselves don’t mention ShinyHunters.
Security journalist Brian Krebs, who first reported the arrest, said Dubrovsky’s case has been transferred to the Eastern District of Texas. The complaint there is sealed, so what he is accused of doing isn’t public.
Krebs could not reach Dubrovsky, who had no attorney listed in court records, and Reuters could not reach CyberSteward, the ransomware negotiation firm listed on his LinkedIn profile.
Officially, the link to ShinyHunters is unconfirmed. The FBI pointed Reuters to Patel’s statement and declined to comment. The Royal Canadian Mounted Police told CBS News only that it is aware of a Canadian arrested in the U.S. in connection with the ShinyHunters hack. The Boston Globe, citing two people familiar with the matter, reported that federal authorities consider Dubrovsky a primary co-conspirator in the FBIjobs.gov breach. Officials have not said so publicly.
The Recovery Firm Case
Zohar Pinhasi, owner of MonsterCloud, faces two counts of wire fraud and one of wire fraud conspiracy, according to the Justice Department. Prosecutors allege he had no special decryption technology and instead paid attackers for keys, then billed clients far more. In one example, he allegedly paid about $8,200 and charged the client about $150,000.
Prosecutors say clients paid MonsterCloud more than $19 million in total, while more than $8 million went to attackers. Pinhasi pleaded not guilty and was released on $2 million bail, the Jerusalem Post reported.
The Case That Ended in Prison
The DigitalMint case shows where these prosecutions can land. Angelo Martino, a former negotiator at the incident response firm, was sentenced in July to 70 months in prison. He admitted passing his clients’ cyber insurance limits and confidential negotiating positions to BlackCat. He also admitted that from April to November 2023 he helped deploy BlackCat ransomware against U.S. companies, working with fellow DigitalMint negotiator Kevin Martin and Ryan Goldberg, a former Sygnia incident response manager.
“Angelo Martino sold out the very victims he was hired to represent,” said Brett Leatherman, assistant director of the FBI’s Cyber Division. Martin and Goldberg each got 48 months.
DigitalMint told CyberScoop it ran background checks and compliance procedures consistent with industry standards, and that Martino hid his conduct through channels only he and the attackers could reach.
That should worry anyone hiring a negotiator. DigitalMint had background checks in place, and one of its own negotiators still sold out its clients. A firm’s vetting can’t guarantee the person working your case is on your side.
What Buyers Can Ask
Jon DiMaggio of XFIL Cyber told CyberScoop in January that no recognized body certifies negotiators or holds them accountable. Without one, he said, victims “end up paying twice.” He called for vetted negotiators and recorded, auditable communications. In the same report, Steve Elovitz of Palo Alto Networks’ Unit 42 said victims should avoid firms paid a percentage of the ransom.
Official guidance draws a hard line on paying, not on talking. CISA recommends victims not pay, and more than 40 countries in the International Counter Ransomware Initiative have pledged their governments won’t pay. None of it sets standards for the negotiators companies hire.
More may be coming. Krebs’ sources say charges against principals at other negotiation firms may follow. The FBI hasn’t commented.
Additional reporting by Tom Spring, Editor-in-Chief, Security Point Break.
