Alleged ShinyHunters Leader ‘Rey’ Detained in Jordan and Cooperating With the FBI Amid Boeing Extortion Probe

A teenager from Amman, Jordan, suspected of orchestrating major data theft and extortion campaigns under the banner of the notorious cybercriminal group ShinyHunters, has been detained by local authorities and is reportedly cooperating with federal investigators. According to security journalism reports, the suspect—who operates online under the hacker handle "Rey"—was apprehended just as the syndicate was actively attempting to extort a recently divested business unit of global aerospace giant Boeing. The case has drawn intense international scrutiny, intersecting with high-profile breaches, international police raids, and shocking subsidiary allegations involving murder-for-hire plots in Europe.

According to investigative reporting by KrebsOnSecurity and initial citations by Reuters from three unnamed sources, the detained suspect has been identified as Saif Al-din Khader. The young man was previously profiled by cybersecurity researchers in November 2025, during which he admitted to maintaining affiliations with multiple ransomware and extortion syndicates.

The investigation gained significant momentum following a series of aggressive public stunts by the suspect. Following the September 15 arrest of 24-year-old Dutch cybercriminal Pepijn van der Stap—who was apprehended by Dutch police on suspicion of aiding ShinyHunters—Rey abruptly assumed control over the online infrastructure and brand identity associated with the hacking group. From there, he launched a series of provocative online taunts directed at both law enforcement agencies and rival cybercrime syndicates.

Using a long-standing account on Twitter/X, Rey posted a flurry of memes mocking the Federal Bureau of Investigation alongside the ransomware group Cl0p. Cleverly attempting to misdirect investigators, his posts incorporated the digital avatar of "Umbreon," a former hacker alias used by Van der Stap, in a transparent attempt to frame the Dutch national for the high-profile digital intrusions.

Technical analyses released by security experts at Mandiant and the Google Threat Intelligence Group (GTIG) revealed that the recent wave of ShinyHunters attacks leveraged a critical zero-day vulnerability, tracked as CVE-2026-35273, affecting Oracle’s PeopleSoft platform. The software-as-a-service solution, widely deployed by global enterprises for human resources, payroll, and recruitment administration, was systematically targeted in mass exploitation campaigns.

Although initial attempts by the group in June reportedly aimed to breach the FBI’s internal recruitment databases—an effort that initially fell short—subsequent efforts used URL-encoding workarounds to bypass web application firewall (WAF) mitigations issued by security vendors. Reuters subsequently reported that the FBI removed an Accenture contractor over failures to patch the compromised recruitment platform, which ultimately exposed sensitive background records belonging to over 5,000 agency personnel, including specialized unit assignments and medical files.

‘REY’ MEANS KING, AS IN ROYAL

Investigators tracking the digital footprints of the ShinyHunters collective soon realized that the scope of their targeting carried striking personal intersections. Sources familiar with the ongoing FBI investigation indicated that the operation reached a critical threshold when the syndicate targeted a navigation and digital aviation unit divested by Boeing.

The compromised unit, Jeppesen ForeFlight, was sold by Boeing to private equity firm Thoma Bravo for $10.55 billion. In statements shared with researchers, Boeing acknowledged being aware of threat actor claims concerning data stolen from the former subsidiary. Meanwhile, representatives for Jeppesen ForeFlight maintained that internal investigations found no operational impact on their products or ongoing enterprise functions.

The connection to Rey’s personal background added a dramatic layer to the probe. Evidence retrieved from password-stealing malware infections on a shared family computer in Amman revealed that Rey’s father utilized identical credentials across internal portals for Royal Jordanian Airlines. The national carrier operates its long-haul fleet using commercial aircraft manufactured by Boeing, while the suspect’s father was widely understood within online circles to work as an airline pilot.

Following inquiries directed toward the family by security journalists, Rey systematically purged his primary social media profiles, dismantling the digital channels used to mock law enforcement. However, a technical blog hosted on GitHub remained active, revealing a fixation on the operators of the Cl0p ransomware ecosystem. A detailed post published on the blog in March 2026 successfully doxed two Russian individuals alleged to be the core developers behind Cl0p.

MURDER FOR HIRE ALLEGATIONS

While authorities in the Middle East focused on Khader, Dutch news outlets broke startling developments regarding the associates of Pepijn van der Stap. Following his release from a multi-year prison sentence for prior cyber extortion offenses—which prosecutors estimated netted between 1.5 million and 2.7 million euros—Van der Stap had publicly cultivated a persona as a reformed security researcher. Prior to his September arrest, he claimed to be working as an "offensive security lead" for Amsterdam-based Neo Security.

However, Dutch daily newspaper RTL reported on September 29 that investigators suspected Van der Stap of orchestrating at least two separate murder plots to be carried out abroad. The allegations dramatically escalated the severity of the proceedings against him, contrasting sharply with his public assertions of rehabilitation.

The Dutch police raid leading to Van der Stap’s arrest involved specialized tactical units utilizing flash-bang grenades. Representatives for Neo Security confirmed that forensic investigators searched their office premises, though preliminary internal reviews found no evidence that Van der Stap had compromised his employer or its client base during his brief tenure.

FRANCHISING AND BURNING A BRAND

Security analysts emphasize that the individuals operating under the ShinyHunters name today bear little direct operational continuity with the group’s original core members, most of whom were French nationals previously rounded up by law enforcement. Instead, ShinyHunters has increasingly functioned as a digital franchise—operating similarly to a succession of figures adopting a shared criminal pseudonym.

Rather than a tightly bound collective, modern iterations rely on freelance affiliates and credential-brokers who feed stolen corporate access into shared negotiation pools in exchange for percentage cuts of subsequent ransom payouts. Following the arrest of Van der Stap and the subsequent detention of Khader, Telegram chat rooms associated with the group erupted into intense infighting and ridicule. Commentators accused Rey of cheapening the syndicate’s reputation by adopting the moniker merely to salvage failed extortions and peddle compromised datasets.

Publicly, members of the collective attempted to frame their aggressive targeting of federal agencies as a strategic pushback against regulatory warnings. In an interview with industry media, representatives for the hackers claimed their digital intrusions were launched to counter public service announcements issued by authorities cautioning victims against paying extortion demands.

Yet, as international law enforcement cooperation tightens across borders from Amman to Amsterdam, the fragile network of affiliates operating beneath the brand continues to unravel. With key figures detained, cooperating with investigators, or facing grave criminal charges, the future viability of the once-prolific extortion franchise faces unprecedented disruption.