Ransomware Negotiator’s Arrest Highlights Gaps in Crisis-Vendor Vetting
Summary
An opinion article links the arrest of a ransomware negotiator charged in connection with ShinyHunters to weaknesses in crisis-vendor oversight, and recommends pre-vetting vendors, checking principals and conflicts, and ongoing review.
Key points
- The FBI arrested Edward Dubrovsky, who faces federal charges connected to the ShinyHunters investigation; the article describes the central allegation as him working with ransomware actors.
- The article says ShinyHunters exploited a known, unpatched Oracle PeopleSoft vulnerability at an FBI contractor and moved to AWS GovCloud, exfiltrating an estimated 2TB to 3TB of employee data, according to the account.
- It argues that crisis-response vendors can receive sensitive breach information and access without the vetting commonly applied to other vendors.
- Recommended checks include verifying principals’ credentials, requiring written conflict-of-interest disclosures, and refreshing reviews over time.
- The article urges organizations to establish a vetted panel of incident-response, negotiation, and forensics vendors before a crisis.
- It recommends embedding cyber expertise in third-party risk management and reviewing vendor performance after significant incidents.
Article Details
- Topic
- Opinion on alleged insider risk involving a ransomware negotiator and the need for stronger vetting and ongoing oversight of crisis vendors, following a ShinyHunters breach of FBI data.
People
Edward DubrovskyFormer Cypfer managing director and ransomware negotiator arrested on federal charges connected to the ShinyHunters investigation; the article describes allegations that he may have worked for the ransomware actors.Kash PatelFBI Director who confirmed Edward Dubrovsky's arrest on Oct. 9.Pepijn van der StapArrested in the Netherlands in connection with the ShinyHunters investigation, according to the article.ReyA 17-year-old identified by the name Rey, arrested in Jordan on Sept. 29 in connection with the ShinyHunters investigation.
Threat Actors
Vendors
AccentureAn Accenture contractor running FBIjobs.gov had left a known Oracle PeopleSoft vulnerability unpatched.CYPFERthe Philadelphia Cyber Risk Summit on Oct. 8 with his name on the sponsorship banner. His former company, Cypfer, was the event's largest sponsor. He'd co-authored a book on ransomware negotiation. He was, by every
Products
AWS GovCloudShinyHunters walked through it, moved laterally to AWS GovCloud, and exfiltrated somewhere between 2TB and 3TB of employee data — names, addresses, Social Security numbers, emergency contacts — including data fromOracle PeopleSoftAn Accenture contractor running FBIjobs.gov had left a known Oracle PeopleSoft vulnerability unpatched.
Countries
Jordanbeen made — Pepijn van der Stap in the Netherlands in September, and a 17-year-old known as "Rey" in Jordan on Sept. 29. Additional charges involving other incident response (IR) firms may follow.Netherlandsarrest on Oct. 9. Two prior ShinyHunters arrests had already been made — Pepijn van der Stap in the Netherlands in September, and a 17-year-old known as "Rey" in Jordan on Sept. 29. Additional charges involving