Alleged Leader of ShinyHunters Detained in Jordan and Cooperating with FBI Following High-Profile Extortion Campaign

A teenager from Amman, Jordan, suspected of orchestrating the operations of the prolific data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the FBI to identify other members of the hacking collective.

According to intelligence gathered by KrebsOnSecurity, the suspect—who operates under the hacker handle "Rey"—was apprehended just as the group was in the middle of an aggressive extortion attempt targeting a business unit recently divested by the global aerospace giant Boeing. In a striking twist of geographic irony, Boeing manufactures the exact fleet of commercial aircraft utilized by Royal Jordanian Airlines, the employer of Rey’s father.

On October 3, Reuters cited three unnamed sources confirming that a suspected ShinyHunters member in Amman named Saif Al-din Khader had been taken into custody by Jordanian law enforcement and was actively assisting the FBI. KrebsOnSecurity previously identified Rey as Khader in a November 2025 investigative profile, wherein the young man candidly admitted to working alongside multiple ransomware syndicates.

Rey’s name surfaced again in a September 28 exclusive detailing the Dutch police arrest of 24-year-old convicted cybercriminal Pepijn van der Stap, who is suspected of aiding ShinyHunters in their data theft and extortion operations. That report highlighted how, immediately following the Dutchman’s arrest on the evening of September 15, Rey seized control of the ShinyHunters brand. He quickly began publicly boasting about stealing highly sensitive data from the Federal Bureau of Investigation and extorting the notorious ransomware operation Cl0p.

To sow confusion and deflect law enforcement attention, Rey taunted both the FBI and Cl0p using memes posted to his long-standing account on Twitter/X. Simultaneously, he incorporated images of the avatar used by Van der Stap’s former hacker alias, "Umbreon," in an apparent, calculated attempt to frame the Dutch national for the brazen hacks.

As previously detailed in late September reports, ShinyHunters managed to breach the FBI’s public recruitment portal and other corporate targets by aggressively exploiting a critical vulnerability, tracked as CVE-2026-35273, affecting PeopleSoft. This widely deployed software-as-a-service platform from Oracle is routinely utilized by major organizations worldwide to manage hiring, human resources, benefits administration, and corporate payroll.

Oracle moved swiftly to issue a security patch after ShinyHunters began weaponizing the vulnerability as a zero-day exploit in June. Concurrently, cybersecurity firm Mandiant released targeted web application firewall (WAF) rules designed to protect organizations that were unable to apply the software update immediately.

According to statements made by ShinyHunters to BleepingComputer in June, the initial objective behind exploiting the PeopleSoft flaw was to breach the FBI’s proprietary PeopleSoft database, although those initial intrusion attempts ultimately proved unsuccessful. However, in the weeks leading up to the arrests, the hackers pivoted, utilizing a well-known URL-encoding technique to successfully bypass the WAF rules recommended by Mandiant.

A joint threat intelligence report released on September 25 by Mandiant and the Google Threat Intelligence Group officially confirmed that ShinyHunters had conducted a mass-exploitation campaign targeting the PeopleSoft vulnerability. The attacks compromised data across dozens of corporate networks spanning a diverse array of industries, including higher education, technology, healthcare, agriculture, transportation, and government sectors.

Further compounding the fallout, Reuters reported on October 5 that the FBI had dismissed an IT contractor working at Accenture following their failure to apply the critical PeopleSoft security patch to the bureau’s recruitment website. The resulting breach exposed sensitive personal data belonging to more than 5,000 FBI personnel, including individual unit assignments, specialized operational roles, and private medical and psychiatric records.

"Rey" Means King, as in Royal

According to two independent sources familiar with the ongoing international investigation into ShinyHunters, a digital navigation and aviation software unit recently divested by Boeing was among the active targets being extorted by the hackers when Jordanian authorities moved in to arrest Rey.

The sources noted that the FBI’s investigation into the group gained immense urgency following the attempted extortion of the former Boeing division. The stolen data reportedly encompassed proprietary information capable of posing severe operational safety and security risks.

In a brief statement provided to KrebsOnSecurity, Boeing acknowledged the extortion attempts directed at the organization, confirming that the incident involved data stolen from Jeppesen ForeFlight. Boeing had previously sold the specialized aviation subsidiary to the private equity firm Thoma Bravo in November 2025 for $10.55 billion.

"We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight," a Boeing corporate spokesperson stated. "We are actively reviewing the matter with the Jeppesen ForeFlight team."

Conversely, a spokesperson for Jeppesen ForeFlight downplayed the operational impact in a written response to inquiries. "Based on our investigation to date into this claim and proactive security posture, there was no impact to our operations or products," the company maintained.

Rey’s alleged involvement in targeting the former Boeing subsidiary carries considerable weight given strong circumstantial evidence connecting his father to Royal Jordanian Airlines. The airline is majority-controlled by the Jordanian government and operates its long-haul international fleet primarily using passenger aircraft manufactured by Boeing. While Rey claimed on Telegram in early 2025 that his father worked as an airline pilot, that specific claim could not be independently verified.

However, forensic analysis detailed in the November 2025 profile of Rey revealed that a shared family computer had previously been compromised by password-stealing malware. Data harvested by the malware clearly demonstrated that Rey’s father routinely used identical credentials to authenticate across multiple administrative portals utilized by Royal Jordanian Airlines employees.

Royal Jordanian Airlines did not immediately respond to requests for comment regarding the security incident. Prior to the publication of the September 28 report, investigators again emailed Rey’s father to apprise him of his son’s escalating legal jeopardy and cybercriminal activities. Neither member of the Khader family responded to the outreach. Within hours of that communication being sent, however, Rey began systematically scrubbing his digital footprint, deleting numerous social media profiles—including the primary Twitter/X handle he used to mock the FBI, Cl0p, and corporate extortion victims.

Despite purging his mainstream social media accounts, Rey’s personal cybersecurity blog hosted on GitHub managed to survive the digital purge. The repository reveals a deep, obsessive fixation on the leadership of the Cl0p ransomware operation. In March 2026, Rey published a lengthy investigative post on the blog explicitly doxing two Russian nationals alleged to be the core developers and masterminds behind the Cl0p syndicate.

Murder for Hire Allegations in the Netherlands

Meanwhile, legal proceedings and investigative reporting in the Netherlands have introduced explosive new allegations against Van der Stap, whose narrative of personal transformation from a convicted cybercriminal to a reformed white-hat security professional had recently garnered considerable attention in European technology media.

According to a report published on September 29 by the Dutch daily news outlet RTL, criminal investigators strongly suspect Van der Stap attempted to orchestrate at least two contract murders. Dutch authorities indicated that the planned attacks were intended to be executed abroad and that evidence suggests Van der Stap personally issued the directives.

Van der Stap had previously served the majority of a four-year prison sentence handed down for extensive data theft and extortion schemes. Dutch prosecutors estimated those earlier operations had generated illicit profits ranging between 1.5 million and 2.7 million euros. In an interview conducted on September 9, Van der Stap presented himself as a rehabilitated individual, describing his new professional role as the "offensive security lead" at Neo Security, a Dutch cybersecurity firm where he purportedly tested client networks for defensive vulnerabilities.

Benjamin Korper, the owner of Neo Security, told Reuters that he immediately retained an outside forensic auditing firm to determine whether Van der Stap had compromised the security of the cybersecurity vendor or any of its clients. Initial findings yielded no evidence that Van der Stap had turned his offensive capabilities against his employer. Korper added that Dutch law enforcement officers descended upon his corporate offices on the night of September 15, executing a dramatic raid involving flash-bang grenades that culminated in Van der Stap’s arrest.

Before his initial legal troubles and 2023 conviction, Van der Stap worked as a software engineer for Hadrian, an Amsterdam-based cybersecurity startup, while simultaneously volunteering with the Dutch Institute for Vulnerability Disclosure. This dual life persisted even as he secretly orchestrated network breaches and extortion plots against numerous major international organizations.

When pressed in interviews about why anyone should place trust in a self-described reformed hacker who had routinely deceived friends, colleagues, and journalists for years, Van der Stap maintained that his subsequent remedial actions spoke for themselves.

"You can throw a bunch of nice words at someone, but you can’t convince them if they don’t want to be convinced," Van der Stap remarked. "I’m doing what I can to repay victims, and that’s all I can do. If someone doesn’t want to believe me, then that’s on them."

Franchising and Burning a Brand

Cybercriminals historically operating under or associated with the ShinyHunters banner have been linked to dozens of massive data breaches resulting in the exposure of billions of stolen records, with campaigns stretching back continuously to at least 2019. Security researchers emphasize, however, that the individuals currently wielding the ShinyHunters brand are distinct from the group’s original core members. Most of those early operators—predominantly French nationals—have previously been rounded up, arrested, and imprisoned for cybercrime activities.

Over time, ShinyHunters has effectively evolved into a decentralized criminal franchise. Cybersecurity experts compare the operational model to the fictional character "Dread Pirate Roberts" from the cult classic film The Princess Bride, where succession occurs not through death, but via law enforcement arrests, often resulting in multiple individuals simultaneously claiming the mantle. Sources close to the ongoing investigations indicate federal authorities are primarily focusing on a residual tier of freelance cybercriminals and affiliates. These actors routinely feed stolen credentials for various corporate software-as-a-service platforms to the network in exchange for a direct percentage of subsequent extortion payouts.

In the wake of Van der Stap’s arrest, a cybercrime-focused Telegram chat server allegedly administered by Rey erupted with internal friction. Fellow threat actors openly ridiculed the teenage hacker after he abruptly backed down from public threats directed at the FBI and Cl0p, a humiliation compounded when the primary ShinyHunters darknet portal abruptly went offline following an FBI ultimatum. Commentators within the underground forums accused Rey of opportunistically hijacking the dormant ShinyHunters brand following the arrest of its original French operators, ultimately degrading the syndicate’s underground reputation.

"He bought the old forum PGP key and used it to make new Breachforum websites and Telegram channels larping as ShinyHunters to ransom companies and then sell the used data or resell his forum when he goes broke," one underground forum member posted.

A newly emerged Telegram tracking channel known as "The Battle" has spent weeks doxing and harassing Rey and other alleged associates of the group, garnering a substantial following across the platform’s cybercrime communities. The administrators of the tracking channel sharply criticized Rey for attempting to leverage a notorious criminal brand.

"Rey (Saif Al-Din Khader) made a serious mistake when he started pretending to be a member of ShinyHunters," the administrators wrote on Telegram. "That group had already been dismantled, with many of its members either arrested or imprisoned, yet Rey still chose to use its name while carrying out his crimes. We’re aware of claims that he caused over $200 million in damages and helped around five to six friend groups in the community make money by using Shiny Hunters group aliases to negotiate deals for a 25 to 30% cut over the past few months."

In a separate interview with The Register, representatives for ShinyHunters claimed their decision to target the FBI was a calculated countermeasure designed to challenge the narrative established in a May 2026 public service announcement published by the Internet Crime Complaint Center. That advisory formally cautioned corporate victims against paying ransoms to the group, characterizing the syndicate’s operational methods in terms that the hackers viewed as unprofessional.

The FBI’s May flash notice warned organizations that ShinyHunters routinely deployed aggressive victim harassment tactics, ranging from persistent threatening phone calls and text messages directed at corporate executives and their families to physical swatting incidents. The bureau also cautioned that group members frequently fabricated claims regarding the possession of sensitive, highly compromising photographs or videos of victims to coerce compliance.

The hackers told The Register that their digital assault against the FBI was executed to "demonstrate our technical capabilities and directly refute the misinformation disseminated by the FBI, journalists, and industry researchers." At the same time, the group’s leadership conceded that the government’s public warnings severely damaged their leverage in convincing corporate victims to submit to extortion demands, acknowledging that the high-profile digital intrusions served primarily as a aggressive public relations and marketing maneuver for their ongoing criminal enterprise.