[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fupohViJviHHLLg4Ydkv4ZCEjAGhURmGqYn1TzfVcEbM":3},{"article":4,"iocs":52,"watch_terms":53,"solutions":54,"lesson":57},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":34},"a7f33a1c-76ec-4f6e-bc6e-de2d2d1fc875","FBI Arrests Founder of Ransomware Negotiation Firm","fbi-arrests-founder-of-ransomware-negotiation-firm-9d4120","Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity.","The FBI has arrested Edward Dubrovsky, co-founder of Canadian cybersecurity firm Cypfer (and associated with CyberSteward), in Pennsylvania. He is suspected of assisting the ShinyHunters hacking group, which recently breached the FBI and exfiltrated sensitive data on thousands of agents. Dubrovsky, who specializes in ransomware negotiations, was attending a cyber insurance conference at the time of his arrest. Federal court records charge him with cyber extortion and conspiracy.","FBI arrests co-founder of ransomware negotiation firm linked to ShinyHunters.","https:\u002F\u002Fkrebsonsecurity.com\u002F2026\u002F10\u002Ffbi-arrests-founder-of-ransomware-negotiation-firm\u002F",null,"2026-10-10T00:17:42+00:00","2026-10-10T02:00:07.729104+00:00",8,[17,20,23,25,27],{"name":18,"type":19},"ShinyHunters","threat_actor",{"name":21,"type":22},"FBI","vendor",{"name":24,"type":22},"Cypfer",{"name":26,"type":22},"CyberSteward",{"name":28,"type":29},"Cyber Extortion Strategic Response","product","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":12,"name":32,"slug":33},"Nation-state","nation-state",[35,40,42,47],{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":41},{"id":30,"icon":12,"name":32,"slug":33},{"category":43},{"id":44,"icon":12,"name":45,"slug":46},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":48},{"id":49,"icon":12,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,24,26],{"controls":55,"vendors":56},[],[],{"slug":58,"title":59,"body":60,"framework_refs":61,"framework_notes":71},"ransomware-negotiator-arrested-for-alleged-collusion-with-threat-actors","Ransomware Negotiator Arrested for Alleged Collusion with Threat Actors","This case highlights the profound insider threat risk embedded within the cybersecurity supply chain — trusted third-party vendors and negotiators are granted privileged access to sensitive incident data, yet may not be subject to the same vetting standards as internal staff. Edward Dubrovsky's alleged collusion with ShinyHunters demonstrates that adversaries actively seek to compromise or recruit individuals in trusted intermediary roles, turning crisis-response relationships into attack vectors. Organizations that engage ransomware negotiators or IR firms share highly sensitive operational and organizational data under extreme duress, often with minimal due diligence. This matters because a compromised negotiator can exfiltrate victim data, extend attacker access, and undermine the integrity of the entire incident response process.",[62,63,64,65,66,67,68,69,70],"NIST SP 800-161 (Supply Chain Risk Management)","NIST IR-6 (Incident Reporting)","NIST AC-2 (Account Management)","NIST AC-17 (Remote Access)","CIS Control 15 (Service Provider Management)","CIS Control 6 (Access Control Management)","ISO 27001 A.15.1 (Information Security in Supplier Relationships)","GDPR Article 28 (Processor Obligations)","ITIL Service Management — Third-Party Vendor Governance",{"NIST AC-17 (Remote Access)":72,"NIST AC-2 (Account Management)":73,"NIST IR-6 (Incident Reporting)":74,"GDPR Article 28 (Processor Obligations)":75,"CIS Control 6 (Access Control Management)":76,"CIS Control 15 (Service Provider Management)":77,"NIST SP 800-161 (Supply Chain Risk Management)":78,"ITIL Service Management — Third-Party Vendor Governance":79,"ISO 27001 A.15.1 (Information Security in Supplier Relationships)":80},"Remote access controls and monitoring for third parties limit what an external negotiator can reach during a ransomware incident.","Account management ensures negotiators' access is granted for the engagement only and promptly removed, limiting insider misuse.","Incident reporting procedures should define what information goes to third parties like negotiators, limiting what a colluding insider can leak.","Where negotiators process personal data from a breach, processor obligations require contracts and guarantees of confidentiality.","Access control management limits third-party negotiators to the minimum data needed, reducing harm if one colludes with attackers.","Service provider management includes vetting and contractual controls for incident response partners, the gap the alleged collusion exposed.","Supply chain risk management extends vetting to incident response vendors and negotiators, who receive privileged access to crisis data.","Vendor governance applies the same scrutiny to trusted crisis intermediaries as to internal staff, the gap this case revealed.","Supplier security agreements should set confidentiality and vetting requirements for negotiators who handle sensitive incident information."]