A Canadian ransomware negotiator faces extortion charges in the FBI’s ShinyHunters crackdown. Here’s what is known, and what isn’t. ShinyHunters is the focus of a global FBI investigation, and the crackdown has led to the October 8 arrest of a Canadian ransomware negotiator who now faces extortion charges. Reuters reported the arrest, citing court documents, prison records and a person familiar with the case. The group has also stolen information about FBI employees. Court documents filed in the Eastern District of Pennsylvania, which includes Philadelphia, accuse the defendant of conspiring to threaten the confidentiality of information to extort money and of interfering with commerce. “A Canadian ransomware negotiator was arrested Thursday and faces unspecified extortion charges, according to court documents, prison records and a person familiar with the matter, as the FBI cracks down on a hacking group that stole information about its employees.” Reuters states. “Edward Dubrovsky faces charges of conspiracy to “threaten to impair the confidentiality of information with intent to extort money” and “interference with commerce,” according to court documents, opens new tab filed with the Eastern District of Pennsylvania, which covers Philadelphia.” Krebs on Security reports that the second charge involves threats. The main criminal complaint remains sealed, so the details of the defendant’s alleged role are not yet public. The records spell the last name two ways, Dobrovsky or Dobrosky, and they don’t list an age, a profession or an employer. A person briefed on the matter told Reuters the defendant is Edward Dubrovsky, a Canadian cybersecurity executive. Reuters couldn’t even settle the spelling, which tells you how early this is. “Federal court records show that on October 8, an Edward Dobrovsky (note the slight misspelling of the last name) was arrested in Pennsylvania on cyber extortion and conspiracy charges.” states the report. “Several of those documents — including the core complaint — are now sealed. But a handful of them were indexed at Courtlistener.com, including a summary of the complaint, which charges the defendant with “conspiracy to threaten to impair the confidentiality of information with the intent to extort money,” and “interference with commerce by threats.”” Federal prosecutors in Philadelphia didn’t return repeated messages about the discrepancies. Reuters also couldn’t reach Dubrovsky, his lawyers, or CyberSteward, the company named on his LinkedIn profile. According to Krebs, the available records showed no attorney yet. “An online search reveals the Cyber Risk Summit was held at the Loews Philadelphia Hotel between Oct. 5 and Oct. 7. The conference had several sponsors, but according to the summit’s website its biggest sponsor was a Canadian security company called Cypfer.” states Krebs. “According to LinkedIn, one of Cypfer’s “ex-founders” was Edward Dubrovsky, who is now associated with another Canadian security firm and sponsor called CyberSteward. In a post to LinkedIn approximately one month ago, Dubrovsky said he had plans to attend the Cyber Risk Summit with the rest of the CyberSteward team.” CyberSteward advertises itself as a specialist in threat actor engagement, cyber extortions, complex negotiations and settlement facilitation. On LinkedIn, Dubrovsky presents himself as an expert in negotiating ransom payments with cybercriminals. SecurityWeek notes he’s also the author of a book on responding to cyber extortion. Politico and Krebs reported the arrest first. Krebs says he was in Philadelphia for a cyber insurance conference. Federal prison records show a man with his name detained at a federal detention center in the city. ShinyHunters is the backdrop. Last month the group claimed it had stolen information on nearly every FBI employee, and it said it got into the bureau’s jobs website and other systems in response to an FBI report earlier this year warning about its activity. FBI blamed the intrusion on a contractor’s failure to patch vulnerable Oracle PeopleSoft software. When Reuters asked about the arrest, the FBI pointed to a statement from Director Kash Patel and declined further comment. Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group – the group believed to be responsible for the recent https://t.co/RG0D4I5KFS incident, which occurred on a platform managed by a third-party vendor. This is the latest arrest… — FBI Director Kash Patel (@FBIDirectorKash) October 9, 2026 Patel described the arrest as the latest in a series of actions against ShinyHunters over just a few days. According to SecurityWeek, he said the FBI will continue working to disrupt the remaining network. This is the third suspected arrest linked to ShinyHunters in recent weeks, following one in the Netherlands on September 15 and another in Jordan on September 28. The case has also moved to another court. A notice filed on October 9 transferred it to the Eastern District of Texas, where sources told Krebs on Security the FBI’s ShinyHunters investigation is focused. However, authorities have not publicly explained what the defendant allegedly did. Reuters reports that the charges have not been specified, and the main complaint remains sealed. Krebs on Security also reports, citing sources, that executives at other ransomware negotiation firms could face charges. The FBI says ShinyHunters has extorted more than $70 million this year. The latest arrest brings the number of suspected ShinyHunters members detained in recent weeks to three. On September 15, authorities arrested a suspected member in the Netherlands. A second alleged key member was reportedly arrested in Jordan on September 28 and is said to be cooperating with the FBI. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, ShinyHunters)
Russian cloud services provider Yandex announced that drone attacks damaged three of its data centers, forcing it to shut down two facilities and partially disable a third. Yandex customers are experiencing service outages, some of them reporting inability to access files stored on the company’s cloud infrastructure. The impacted data centers are in Sasovo (hit on October 8), Kaluga (hit on October 9), and Vladimir (attacked on October 11). The Sasovo and Vladimir facilities stopped operating completely, while the Kaluga facility's operations are degraded. The attacks are believed to have been carried out by Ukrainian forces trying to cause widespread operational disruptions. Yandex reported no injuries related to these incidents. As Russia’s largest technology companies, Yandex is often called “Russia’s Google,” offering search engine, maps, and navigation services. The company also offers ride-hailing, delivery, shopping, streaming, email, cloud storage, and business cloud infrastructure services.
Attackers remotely defrosted refrigerators at multiple French supermarket chains overnight in a cyberattack that reportedly targeted Danfoss refrigeration controllers. Victims include Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U, with French outlets reporting that the attack affected 250 to 350 stores, causing significant financial losses and food waste. The threat actors hijacked refrigeration controllers running older versions of Danfoss control software on Sunday night and used them to raise supermarket refrigerator temperatures by triggering a built-in automatic defrosting system. "Following a cyberattack reportedly affecting a service provider that manages refrigeration systems in stores, some fresh and frozen food display units are out of service," an Intermarché spokesperson told BleepingComputer when asked for more information on the incident. "Intermarché and Netto have taken all necessary precautions to remove the products from these units as quickly as possible. We don't have further information currently, nor a specific list of affected stores to share with you."
CyberLeek threatens to leak a playable GTA 6 build if its Solana meme coin hits a $30 million market cap, but the build remains unverified. CyberLeek, the anonymous figure behind this summer’s wave of GTA 6 leaks, just raised the stakes considerably. After dropping 25 minutes of gameplay footage earlier last week, including nudity and dev menu access, they’re now threatening to release a complete, playable build of the game, start to finish. “A GTA 6 leaker has reportedly threatened to put out a complete, playable build of the game, start to finish.” reads Eurogamer.net. “The threat was posted on CyberLeek’s website after the leaker shared 25 minutes of footage from the game earlier this week.” CyberLeek posted the threat on its own website. The demand is simple: if its cryptocurrency reaches a $30 million market value, the leaker will release the playable build of GTA 6, including the full story mode, from start to finish, with the ending credits. CyberLeek says Take-Two can avoid the leak only by providing physical copies of the game and issuing a public apology. This sounds more like a challenge than a serious negotiation. “Here’s the deal, nice and clean,” the leaker states. “CyberLeek hits 30 million marketcap, the build goes out — full story mode, played to the end, credits and all. Don’t believe it has full story mode? Ask for what you want to see, and it gets provided. Take-Two gets one way out: physical disks and a public apology. They can take it at any moment. Or they can gamble that CL is bluffing. Everyone knows which one they’ll pick.” This is not CyberLeek’s first leak. Rockstar previously said the situation was painful and that this was not how it wanted fans to see the game after years of waiting. Take-Two, Rockstar’s parent company, has been trying to identify the leaker and even sought a court order requiring Discord to share information about their identity. The company is actively trying to stop the leaks rather than waiting for the situation to pass. Take-Two, Rockstar’s parent company, has been actively hunting for the leaker and tried subpoenaing Discord for identifying information, so this isn’t a studio sitting back and hoping it blows over. The efforts to stop the leaks have not worked so far. CyberLeek went silent for a while, then returned with new footage showing Jason fully naked and Lucia topless. Eurogamer reported that the video appears to be real and carries CyberLeek’s usual watermark. CyberLeek did more than leak game footage. It also launched a Solana meme coin and uses the videos to promote it. Reports said the coin reached a market value of $25 million in late August, with more than $36 million in trading volume in a single day. Its value then fell sharply after Rockstar released official gameplay footage on Netflix and interest in the leaks declined. The new $30 million target is important because reaching it could trigger the release of a playable version of GTA 6 before the official launch. Whether CyberLeek genuinely has a full playable build worth leaking is still unverified. “The knowledge that a playable build of GTA 6 might be online has unsurprisingly encouraged hackers to lure curious users searching for it on unfamiliar websites.” states TechSpot. “Files labeled as the build have recently appeared on torrent websites, but these are certainly malicious. There is no evidence that CyberLeek or anyone else has, or even can, release an early version of the game.” Fake downloads claiming to be the leaked build have already started circulating on torrent and piracy sites, several reportedly carrying malware, so anyone tempted to go looking is more likely to get infected than to get an early copy of GTA 6. Take-Two has already lost close to $2.8 billion in market value over a 48 hour stretch tied to this leak saga, which tells you how seriously the market is taking the threat, even unverified. GTA 6 is still set for a November 19 release on PlayStation 5 and Xbox Series X/S, and neither Rockstar nor Take-Two has commented on this latest ultimatum. Extortion tied to a crypto pump scheme is a genuinely new flavor of leak drama, and it probably won’t be the last time someone tries combining the two. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, GTA 6)
Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone do something about it. But speed is only part of the problem. A secure connection didn't always mean a safe destination. People offering to fix a ransomware mess had questions to answer themselves.
Canadian cybersecurity executive Edward Dubrovsky has been arrested in Pennsylvania in connection with alleged extortion activity that multiple reports have linked to the FBI's ongoing crackdown on the ShinyHunters hacking group. Dubrovsky, 54, has had senior roles at cybersecurity firms that help data breach and ransomware victims negotiate extortion payments with cybercriminals. Yesterday, FBI Director Kash Patel announced that agents had arrested "another suspected co-conspirator of the ShinyHunters group". The New York Times reported that the suspect was a Canadian citizen arrested in Pennsylvania and believed to be a primary co-conspirator in the recent ShinyHunters FBI Jobs hack. Last night, both Politico and KrebsOnSecurity reported that Dubrovsky was arrested in Pennsylvania, where he was attending a cybersecurity conference.
As enterprises race to deploy autonomous AI agents to accelerate business, a new report reveals they are tethered to security architectures built for a different era. The "Horizons of Identity Security" report from SailPoint highlights a critical “velocity paradox,” in which organizations invest in AI-speed business operations while continuing to rely on human-speed security controls, creating a
The crooks have trust problems of their own. One ransomware affiliate decided to keep the profits for himself. Elsewhere, an attacker left a server exposed, complete with tools and traces of an intrusion. Apparently, keeping things secure is a problem on both sides of the fence. The rest of the week isn't much more reassuring. Malicious code turned up in developer packages and extensions that
Phishing kits are no longer limited to copying a familiar login page and waiting for a victim to enter credentials. Attackers are increasingly building filtering, session management, and traffic controls into the infrastructure that delivers the phishing page itself. ANY.RUN has identified Wazza, a new phishkit targeting banking, manufacturing, and government organizations across the US, Europe
The U.S. Department of Justice (DoJ) on Wednesday announced charges against a 50-year-old U.S. and Israeli national for allegedly defrauding ransomware victims by secretly paying the attackers to obtain decryptors while claiming to use proprietary tools to recover their data. Zohar Pinhasi (aka Zack Silver and Zack Green) has been charged with two counts of wire fraud and one count of wire
Confirm this action.
Leaving now will discard your changes.