Key ShinyHunters Suspect Detained in Jordan and Cooperating with the FBI Amid Escalating Global Cybercrime Probe

A teenager from Amman, Jordan, suspected of acting as a central figure in the prolific data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the FBI to identify other members of the hacking collective.

According to investigative findings by KrebsOnSecurity, the suspect—who operates online under the hacker handle “Rey”—was taken into custody just as ShinyHunters was actively attempting to extort a business unit recently divested by global aerospace giant Boeing. In a striking twist of digital geography, the aerospace manufacturer builds the exact fleet of commercial aircraft utilized by Royal Jordanian Airlines, the employer of Rey’s father.

The international dragnet tightened on October 3 when Reuters cited three unnamed sources confirming that a suspected ShinyHunters operative in Amman named Saif Al-din Khader had been detained by Jordanian law enforcement and was actively assisting the FBI. KrebsOnSecurity had previously identified "Rey" as Khader in an investigative profile published in November 2025, during which the young man admitted to collaborating with multiple ransomware operations.

Rey’s name resurfaced prominently in a September 28 exclusive concerning Dutch police arresting 24-year-old convicted cybercriminal Pepijn van der Stap. Authorities suspect Van der Stap aided in data thefts and extortions orchestrated by ShinyHunters. Immediately following the Dutchman’s dramatic arrest on the evening of September 15, Rey seized control of the ShinyHunters brand, taking to public channels to boast about breaching sensitive systems belonging to the FBI and extorting the notorious Cl0p ransomware operation.

To deflect suspicion and frame his rival, Rey taunted both the FBI and Cl0p with a series of mocking memes posted to his long-standing account on Twitter/X. These posts deliberately featured images of the avatar once utilized by Van der Stap under his former hacker alias, “Umbreon.”

The underlying infrastructure breaches tied to this campaign stemmed from the mass exploitation of a security vulnerability cataloged as CVE-2026-35273. The flaw targeted PeopleSoft, a software-as-a-service platform developed by Oracle and deployed extensively across corporate environments for human resources, benefits, payroll, and recruitment administration.

Oracle rushed out security patches after ShinyHunters began weaponizing the vulnerability as a zero-day exploit in June. Concurrently, cybersecurity firm Mandiant issued web application firewall (WAF) rules to assist organizations unable to immediately apply the vendor update. While initial attempts by ShinyHunters to breach the FBI’s own PeopleSoft database in June proved unsuccessful, the group later pivoted to a well-documented URL-encoding bypass trick to circumvent Mandiant’s defensive rules.

In a joint threat intelligence report published on September 25, security analysts with Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters had successfully mass-exploited the PeopleSoft vulnerability. The attacks compromised data across dozens of corporate networks, touching industries as varied as higher education, technology, healthcare, agriculture, transportation, and government sectors.

Further complicating the fallout, Reuters reported on October 5 that the FBI had dismissed an Accenture contractor due to their failure to patch the compromised FBI recruitment portal. The breach exposed sensitive personnel records belonging to more than 5,000 FBI staff members, detailing specific unit assignments, operational specializations, and confidential medical and psychiatric records.

"Rey" Means King, as in Royal

Sources close to the ongoing international investigation revealed that when Jordanian authorities moved in to apprehend Rey, the suspect was heavily involved in extorting a navigation and digital aviation unit recently spun off by Boeing. The FBI’s investigation into ShinyHunters acquired a renewed sense of urgency following this specific extortion attempt, as the stolen data involved proprietary aviation information carrying potential operational safety and security risks.

In a brief official statement provided to KrebsOnSecurity, Boeing acknowledged the attempted extortion campaign, confirming the targeted assets originated from Jeppesen ForeFlight. Boeing had previously divested the subsidiary in November 2025, selling it to the private equity firm Thoma Bravo in a transaction valued at $10.55 billion.

"We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight," a Boeing corporate spokesperson stated, noting that internal teams were actively investigating the claims alongside Jeppesen ForeFlight personnel. Representatives for Jeppesen ForeFlight maintained that their internal systems remained secure, stating that their investigation found no operational or product impact.

Rey’s alleged role in targeting the aviation unit draws additional scrutiny given evidence pointing to his father’s employment with Royal Jordanian Airlines, a carrier largely controlled by the Jordanian government that operates long-haul flights on Boeing aircraft. While Rey claimed on Telegram in early 2025 that his father worked as an airline pilot, those assertions could not be independently verified.

However, forensic analysis of malware-infected family computer logs uncovered by investigators revealed that Rey’s father routinely utilized identical login credentials across multiple employee-facing portals for Royal Jordanian Airlines.

Royal Jordanian Airlines has not responded to multiple requests for comment regarding the security implications. Shortly after KrebsOnSecurity contacted Rey’s father ahead of the September 28 publication to outline his son’s alleged activities, Rey systematically began purging his social media footprint, scrubbing the Twitter/X accounts previously used to taunt law enforcement and corporate victims.

Despite wiping his mainstream social profiles, Rey’s technical blog hosted on GitHub remained active. A lengthy post published on the blog in March 2026 attempted to dox two Russian individuals identified by Rey as the core developers and hackers running the Cl0p ransomware operation.

Murder for Hire Allegations

Meanwhile, legal proceedings in the Netherlands introduced startling new accusations against Van der Stap. Despite widespread media coverage celebrating his purported rehabilitation following a prior conviction, Dutch daily newspaper RTL reported on September 29 that investigators suspect Van der Stap of orchestrating at least two murder-for-hire plots directed at targets abroad.

Van der Stap had recently completed the majority of a four-year prison sentence stemming from data theft and extortion schemes that prosecutors estimated generated between 1.5 million and 2.7 million euros. In a September 9 interview, Van der Stap claimed to be working as an "offensive security lead" for Dutch cybersecurity firm Neo Security, conducting authorized network penetration tests for clients.

Neo Security owner Benjamin Korper told Reuters that an independent forensic firm was retained to audit Neo Security’s networks for unauthorized access by Van der Stap, though no evidence of internal compromise has surfaced. Korper confirmed that Dutch law enforcement officers executed a raid on his corporate office on the evening of September 15, an operation local media reported involved the deployment of flash-bang grenades.

Before his initial 2023 arrest, Van der Stap worked as a software engineer at Amsterdam-based security startup Hadrian while concurrently volunteering for the Dutch Institute for Vulnerability Disclosure (DIVD), all while covertly breaking into corporate systems. Confronted about the challenges of convincing the public of his reformation, Van der Stap remarked that his actions would ultimately speak for themselves.

"You can throw a bunch of nice words at someone, but you can’t convince them if they don’t want to be convinced," Van der Stap said. "I’m doing what I can to repay victims, and that’s all I can do."

Franchising and Burning a Brand

While actors operating under the ShinyHunters banner have claimed responsibility for data breaches impacting billions of records since 2019, cybersecurity researchers emphasize that the modern incarnation bears little resemblance to the group’s original French core members, many of whom have faced arrest and prosecution.

Instead, ShinyHunters has evolved into an opportunistic franchise model. Much like the literary concept of the Dread Pirate Roberts, where the moniker persists across successive individuals, the group operates through decentralized freelancers and affiliates. These operators feed stolen corporate software credentials to the collective in exchange for a percentage of any collected ransoms.

In the wake of Van der Stap’s arrest, underground Telegram channels operated by Rey became battlegrounds of ridicule. Critics accused the teenager of hijacking the dormant ShinyHunters brand for financial gain after the original members were dismantled by European law enforcement.

"He bought the old forum PGP key and used it to make new Breachforum websites and Telegram channels larping as ShinyHunters to ransom companies," one forum member noted.

A rival Telegram monitoring channel dubbed "The Battle" repeatedly targeted Rey and his associates, asserting that the teenager generated substantial illicit revenue by managing extortion negotiations for allied hacker circles under the borrowed ShinyHunters identity.

In an interview with The Register, representatives for the modern ShinyHunters faction asserted that their cyberattack against the FBI was executed to counter public guidance issued in a May advisory that cautioned organizations against paying extortion demands. While the hackers claimed the breach demonstrated their technical capabilities as a public relations maneuver, the group acknowledged that federal warnings severely impaired their ability to secure ransom payouts from corporate victims.