Alleged Teenage Leader of ShinyHunters Detained in Jordan and Cooperating With FBI Amid High-Profile Extortion Case

A teenager from Amman, Jordan, suspected of acting as a central figure and brand administrator for the prolific data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the FBI to identify other members of the hacking collective.

According to investigative reporting by KrebsOnSecurity, the suspect—who uses the online hacker handle "Rey"—was apprehended just as the cybercrime collective was actively engaged in extorting a business unit recently divested by global aerospace giant Boeing. In a striking twist of geographic irony, Boeing manufactures the commercial aircraft fleet utilized by Royal Jordanian Airlines, the employer of Rey’s father.

On October 3, Reuters cited three unnamed sources confirming that a suspected ShinyHunters member in Amman named Saif Al-din Khader had been taken into custody by Jordanian law enforcement and was actively cooperating with federal investigators from the United States. KrebsOnSecurity previously identified Rey as Khader in a November 2025 investigative profile, in which the young man openly admitted to collaborating with multiple ransomware operations.

Rey’s name surfaced again in late September during an exclusive report detailing the Dutch police’s arrest of 24-year-old convicted cybercriminal Pepijn van der Stap. Van der Stap was apprehended on suspicion of facilitating data thefts and extortion campaigns orchestrated by ShinyHunters. According to security findings, immediately following the Dutchman’s dramatic arrest on the evening of September 15, Rey seized control of the ShinyHunters brand assets. He quickly began publicly boasting about breaching sensitive systems belonging to the FBI and launching retaliatory extortions against the rival ransomware syndicate Cl0p.

To further complicate the investigation, Rey taunted both federal law enforcement and the Cl0p ransomware group using memes posted to his established social media account on Twitter/X. Within these digital taunts, he deliberately embedded images of the avatar previously utilized by Van der Stap under his former hacker alias, "Umbreon," in an apparent, calculated attempt to frame the Dutch national for the fresh wave of high-profile cyberattacks.

The technological vector behind these breaches traces back to a software vulnerability tracked as CVE-2026-35273. The flaw targeted PeopleSoft, a widely deployed software-as-a-service platform from technology giant Oracle used extensively by corporate enterprises for human resources, recruitment, payroll, and benefits management. Oracle quickly issued an emergency patch after ShinyHunters began weaponizing the vulnerability as a zero-day exploit in June. Concurrently, cybersecurity firm Mandiant released web application firewall (WAF) rules to protect organizations unable to immediately apply the security update.

While ShinyHunters initially claimed in June communications with technology news outlets that their primary objective was breaching the FBI’s internal PeopleSoft database—an attempt that initially failed—the group later adapted. In subsequent weeks, the hackers bypassed Mandiant’s defensive firewall rules by employing a well-known URL-encoding trick.

A comprehensive threat intelligence report released on September 25 by Mandiant and the Google Threat Intelligence Group confirmed that the hackers had mass-exploited the PeopleSoft vulnerability. The campaign successfully compromised dozens of systems spanning diverse critical sectors, including higher education, technology, healthcare, agriculture, transportation, and government agencies.

Further compounding the fallout, Reuters reported on October 5 that the FBI dismissed an Accenture contractor following revelations of a severe failure to patch the agency’s recruitment portal. That security lapse left exposed sensitive records detailing the units, specializations, and even medical and psychiatric files of more than 5,000 FBI personnel.

‘Rey’ Means King, as in Royal

According to sources close to the international investigation, a digital aviation and navigation unit divested by Boeing stood squarely in the crosshairs of ShinyHunters’ extortion demands at the moment Jordanian authorities moved in to detain Rey. The attempted extortion of the former Boeing division injected a profound sense of urgency into the FBI’s ongoing probe, largely because the stolen data allegedly carried operational safety and security implications.

In a statement provided to security researchers, Boeing acknowledged awareness of the extortion threats directed against data linked to its former subsidiary, Jeppesen ForeFlight. Boeing completed the sale of Jeppesen ForeFlight to private equity firm Thoma Bravo in November 2025 for $10.55 billion. Representatives for Jeppesen ForeFlight maintained that their proactive security posture insulated them from harm, stating that an internal investigation revealed zero impact on ongoing operations or commercial products.

Rey’s alleged involvement in the Boeing unit extortion scheme draws additional scrutiny due to compelling evidence linking his family to Royal Jordanian Airlines. The airline, largely controlled by the Jordanian government, operates long-haul routes using Boeing aircraft. Although Rey claimed on Telegram in early 2025 that his father worked as an airline pilot—a detail that could not be independently verified—digital forensics paint a clearer picture. As documented in earlier security profiles, a family computer compromised by password-stealing malware revealed that Rey’s father utilized identical credentials across multiple administrative portals for Royal Jordanian Airlines employees.

Following inquiries from journalists, Royal Jordanian Airlines did not immediately respond to requests for comment. Shortly after security researchers contacted Rey’s father to apprise him of his son’s digital activities, Rey began systematically purging his digital footprint, deleting numerous social media profiles—including the Twitter/X account used to mock federal law enforcement and corporate victims.

Despite scrubbing his mainstream social media presence, Rey’s technical blog hosted on GitHub remained active. The blog featured a lengthy investigative post published in March 2026 that attempted to dox two Russian men alleged to be the core developers and masterminds behind the Cl0p ransomware operation.

Murder-for-Hire Allegations Surface in the Netherlands

While international attention focused on the teenage suspect in Amman, Dutch media outlets published explosive allegations concerning Pepijn van der Stap. Despite widespread public narratives depicting Van der Stap as a reformed cybercriminal following his release from a four-year prison sentence for extortions netting up to €2.7 million, investigators in the Netherlands revealed darker suspicions.

According to a report by Dutch broadcaster RTL, law enforcement suspects that Van der Stap attempted to orchestrate at least two murders abroad, allegedly issuing direct orders for the attacks. Prior to his dramatic September 15 arrest—which involved a tactical police raid utilizing flash-bang grenades—Van der Stap had secured employment as an "offensive security lead" at Neo Security, an Amsterdam-based cybersecurity firm.

Benjamin Korper, the owner of Neo Security, confirmed that he retained an external forensic firm to investigate whether Van der Stap had compromised the company or its clients. Thus far, investigators have found no evidence of malicious internal activity directed against the employer.

Before his initial 2023 conviction, Van der Stap maintained a dual existence, working as a software engineer for an Amsterdam cybersecurity startup while volunteering for the Dutch Institute for Vulnerability Disclosure—all while quietly breaching and extorting major international organizations. When previously confronted about how colleagues and victims could trust his claims of rehabilitation, Van der Stap maintained that his actions and ongoing efforts to repay victims were all he could offer.

Franchising and Burning a Brand

Security experts note that the actors currently operating under the ShinyHunters banner bear little operational relation to the group’s original French core members, most of whom have previously faced arrest and imprisonment. Instead, ShinyHunters has evolved into a decentralized criminal franchise.

Security researchers compare the modern iteration to the fictional "Dread Pirate Roberts" persona from popular culture, where the mantle is continuously assumed by new successors following the arrest of previous holders. Federal investigators have increasingly concentrated their efforts on freelance affiliates who harvest and feed stolen corporate SaaS credentials to extortion groups in exchange for a percentage of ransoms paid by victims.

In the wake of Van der Stap’s arrest, underground chat servers on Telegram associated with Rey erupted in internal strife. Cybercrime community members heavily mocked the teenager after he backed down from public threats against the FBI and Cl0p, a retreat that coincided with the sudden offline status of the ShinyHunters darknet portal.

Critics within the cybercrime underground accused Rey of commercializing a legacy brand name after the original members were dismantled by law enforcement. Observers alleged that Rey acquired old PGP keys and forum assets to establish counterfeit BreachForums channels and Telegram groups, leveraging the ShinyHunters notoriety to execute low-level extortions and sell stolen data for personal enrichment.

A specialized Telegram tracking channel known as "The Battle" relentlessly doxed and criticized Rey and his associates, portraying the teenager as an inexperienced greenhorn riding the coattails of an infamous brand. According to administrators of the tracking channel, Rey allegedly caused substantial financial damages while operating auxiliary affiliate rings that negotiated corporate extortion deals in exchange for a 25 to 30 percent cut.

The public exposure underscored an unusual public relations strategy pursued by the hackers. In interviews with technology media outlets, representatives of the group claimed their digital incursions against federal law enforcement were executed specifically to counter official agency warnings advising victims against paying ransoms. While the hackers asserted the attacks demonstrated technical prowess and challenged public advisories, security analysts observed that public awareness campaigns by law enforcement have severely degraded the group’s financial viability, turning high-profile operations into desperate attempts to salvage a deteriorating criminal enterprise.