Ransomware Negotiator Legal Risk

The man who negotiated ransomware payments for a living is now charged with extortion himself. FBI agents arrested Edward Dubrovsky, 54, on Thursday, October 8, 2026, according to KrebsOnSecurity. He has not been convicted. The case exposes the legal risk for companies that hire negotiators to deal with ransomware gangs, and the record is thinner than the headlines suggest.

The charging papers, described by reporters who have seen the docket, list conspiracy under 18 U.S.C. 371 and 1030(a)(7)(B) (an agreement to threaten to impair the confidentiality of information to extort money) and under 18 U.S.C. 1951(a) and (b)(2), Hobbs Act extortion and conspiracy. The complaint is sealed. These are allegations. The public record does not yet describe the acts prosecutors say he committed.

KrebsOnSecurity reported on October 9, 2026 that FBI agents arrested an executive at a Canadian cybersecurity firm on Thursday, and that multiple sources tied the arrest to the bureau’s investigation of ShinyHunters after that group took sensitive data on thousands of agents. BleepingComputer identified the man as Edward Dubrovsky and placed the arrest in Pennsylvania. A sealed complaint and a stack of anonymously sourced links are not the same thing. Teams that hired his firms need the docket, their own logs, and a clear split between what reporters have said and what a court has found.

The Pennsylvania complaint and the ShinyHunters reporting

Court records from Dubrovsky’s initial appearance in the Eastern District of Pennsylvania, as described by NTD, charge conspiracy to “threaten to impair the confidentiality of information with intent to extort money” and “interference with commerce.” The case has since been transferred to the Eastern District of Texas, where the charges were filed. Nextgov reported the same pair of theories: threatening to disclose stolen or hacked information, and interfering with interstate commerce through extortion. The docket itself lists “18:371 AND 1030(a)(7)(B)” and “18:1951(a) AND (b)(2),” as BleepingComputer quoted it. Cornell’s Legal Information Institute notes that the Hobbs Act authorizes a sentence of not more than 20 years. That number is the statutory maximum, not a sentence imposed on Dubrovsky.

MonsterCloud charges and the BlackCat sentence

The Dubrovsky case is not the only 2026 prosecution of someone who sold help to ransomware victims. Two separate matters are at different stages. One is a set of wire-fraud allegations. One is a prison sentence after a guilty plea.

The markup, if the allegation holds, is the part a finance team can audit. Prosecutors say that in one August 2023 engagement the company sent a cybercriminal about $8,200 and billed the client about $150,000. SecurityWeek put the markup at about $11 million: prosecutors say the company paid more than $8 million in ransoms while charging clients more than $19 million. Those figures are prosecution allegations relayed by news outlets, not a published judgment. A single “recovery” line that hides an attacker payment is the pattern on the page.

Angelo Martino’s case has already been sentenced. The Justice Department said Martino, 41, of Land O’Lakes, Florida, formerly employed as a negotiator, was sentenced to 70 months for conspiring with BlackCat/ALPHV actors to extort multiple victims, and for conspiring with other former cybersecurity professionals to attack additional victims in 2023. The Hacker News reported that the conduct included giving victim negotiation data to BlackCat operators. TechTarget reported that he was employed by DigitalMint in 2023 and abused that role to pass confidential negotiating information to BlackCat/ALPHV. Martino pleaded guilty on April 14, 2026, and the court accepted the plea on April 20, according to the Justice Department; BleepingComputer reported the plea on April 21, 2026. Seventy months is a sentence, not a charge. The Justice Department said before sentencing that he faced a maximum of 20 years; that was the statutory exposure, not the term the court imposed.

Defendant	Age	Public posture	What the record describes	Source
Edward Dubrovsky	54	Sealed complaint; allegations; not convicted	Conspiracy to threaten to impair confidentiality of information to extort money, plus Hobbs Act extortion conspiracy. Charging district: Eastern District of Texas; initial appearance in the Eastern District of Pennsylvania; transferred October 19, 2026	KrebsOnSecurity and Nextgov, citing Bureau of Prisons records; court records do not state his age
Zohar Pinhasi	50	Wire fraud charges; arraigned October 7, 2026	Alleged false claim that MonsterCloud could decrypt without paying attackers, while secretly buying decryption keys	US Department of Justice
Angelo Martino	41	Sentenced to 70 months after a guilty plea	Conspired with BlackCat/ALPHV to extort victims and passed victim negotiation data to operators	US Department of Justice

The three rows are not the same legal event. Dubrovsky’s complaint is sealed, so the conduct is not public. Pinhasi is accused of lying about method and price. Martino admitted, by the guilty plea the Justice Department described, to helping the operators he was supposed to be bargaining with. A review that treats “incident response vendor” as a single risk category will miss that split. The invoice pattern and the intelligence-sharing pattern need different controls.

Require a written answer, in the statement of work, on whether the firm will pay an attacker at all.
Refuse a single “recovery” invoice. Demand a split between any attacker payment and professional fees before approval. The August 2023 figures, about $8,200 out and about $150,000 billed, are the scale prosecutors described in one engagement.
Prohibit the outside firm from holding the only copy of negotiation notes. Martino’s sentence is the worked example of what those notes are worth to an operator.
Ask which crews a principal has touched in prior employment, and write BlackCat/ALPHV into that question when the incident names that group.

OFAC exposure when a payment is helped

A criminal charge against an intermediary does not replace the sanctions question the victim still has to answer if anyone wires money. On October 1, 2020, the Treasury Department’s Office of Foreign Assets Control issued an advisory on sanctions risks for helping ransomware payments. The advisory says OFAC is highlighting sanctions risks associated with ransomware payments related to malicious cyber-enabled activity. An updated advisory followed on September 21, 2021, with further guidance for companies facing an attack or processing a payment. Sullivan and Cromwell’s memo on that update describes it as additional guidance on mitigating the risk of a sanctions violation connected to a payment.

A plain-language account of the updated advisory says making or helping a payment may violate US sanctions rules if the recipient is a sanctioned person or is in an embargoed jurisdiction, and that liability can be strict. The same account says sound security practice and prompt reporting to law enforcement count as mitigating factors, and it labels itself as not legal advice. Strict liability, if it applies to the facts, does not turn on whether the payer meant to deal with a listed person. Screening after the coins have moved is not screening.

The 2021 update is not a 2026 rulemaking, and it should not be confused with unrelated OFAC actions against other countries. What it still does, in a year when response executives are themselves defendants, is put the facilitation question on the victim’s counsel, not on the vendor who may be the person under investigation. If the only party who knows the destination wallet is the outside firm, the victim cannot document a screening it never performed. Pinhasi’s alleged method, paying the attacker while describing a proprietary decryptor, is the arrangement that hides the recipient from the client officer who would have to sign a sanctions check.

Screen the recipient before any transfer, and keep the screening record with the incident file, not in the vendor’s portal alone.
If a payment is made, report to law enforcement promptly. The 2021 advisory’s mitigating-factor discussion is the reason to do that before the transfer, not after a regulator asks.
Name the wallet, the chain, and the approving officers in the same record. An intermediary should not be the only person who can produce that list.
Have counsel re-read the September 21, 2021 update against the specific recipient before funds move. A blog summary is not the screening.

Contract and logging controls before the next incident

Dark Reading’s October 16, 2026 piece argued that the arrest shows a need for oversight of vendor programs. The three cases examined here point at narrower failures: a sealed charge against a known principal, an alleged hidden payment, and a sentenced employee who fed negotiation data to BlackCat. Each one is detectable in paperwork the victim already generates, if that paperwork is not left with the vendor.

The engagement letter should name the legal entity, the beneficial owners, and every principal who will see victim data. CYPFER, CyberSteward, MonsterCloud, and DigitalMint are four different relationships in the public record. A master services agreement that says “consultant” and never names the humans will not tell you, on the morning of an arrest, whether your incident file sits with a charged former managing director. Ask for prior incident-response employers in writing. Martino’s DigitalMint role in 2023 is the reason that question is not a formality.

Split duties the way a payment desk already splits wires. The person who talks to the threat actor does not approve the transfer. Two client officers approve any payment, and neither is the outside intermediary. The client tenant stores the chat export, the call notes, and the invoice. A vendor who will only discuss terms inside its own portal is asking the victim to recreate the condition Martino exploited: confidential bargaining positions that an insider can forward. If a principal is arrested or charged, the client should be able to halt the work and demand return of victim data and communications. Write the trigger (arrest or charge) and the deliverable (return of the file) and let counsel set the clock.

Before each engagement, check principals against court dockets and recent charging announcements, not only against a sanctions list. During an incident, compare the wallet in the attacker’s demand with the wallet on any invoice. A recovery line that does not itemize an attacker payment is the MonsterCloud pattern, whether or not this vendor is MonsterCloud. After the incident, keep the approval record: who screened the recipient, which OFAC list was checked, and whether law enforcement was notified. That packet is what the 2021 advisory’s mitigating factors actually refer to.

Refusing to let a specialist speak to the actor can slow a negotiation when systems are down and a leak site deadline is public. Dual control adds hours. Keeping logs in the client tenant means the client has to staff that tenant at 2 a.m. The alternative, handing the whole channel to one firm, is the arrangement all three cases put under a light. Dubrovsky has not been convicted, and his complaint does not yet say what he did. Pinhasi has not been convicted either. Martino has. The hiring decision does not need a verdict to require that the victim, not the intermediary, holds the payment decision and the record of it.

Name the entity, the owners, and every principal who will see victim data before work starts.
Put payment approval on two client officers. The outside firm does not hold unilateral wallet control.
Store negotiation logs in the client’s tenant, with a suspension-and-return clause if a principal is arrested or charged.
Match demand wallets to invoice wallets, and file the sanctions screening with the law-enforcement notice in the same incident record.

Sources and References

Sources cited while researching and writing this article:

Correction, October 21, 2026: An earlier version described Dubrovsky as a CYPFER co-founder. CYPFER says he was a managing director from May 2022 to December 2025 and was not a founder. The article also corrected the KrebsOnSecurity report date to October 9 and the Martino plea date to April 14; the court accepted the plea on April 20. It also corrected the Globe and Mail characterization: Dubrovsky said he was collateral damage in Daniel Tobok’s campaign, not that Tobok drew him into it. It corrected the charging venue: the charges were filed in the Eastern District of Texas, and the Eastern District of Pennsylvania proceeding was a removal hearing. The SecurityWeek markup is about $11 million, based on more than $8 million paid in ransoms and more than $19 million charged to clients.

The Pennsylvania complaint and the ShinyHunters reporting

MonsterCloud charges and the BlackCat sentence

OFAC exposure when a payment is helped

Contract and logging controls before the next incident

Sources and References

Rafael