Suspected Key Leader of ShinyHunters Detained in Jordan and Cooperating With the FBI

A teenager from Amman, Jordan, suspected of orchestrating high-profile data theft and extortion campaigns under the notorious banner of the ShinyHunters cybercrime group, has been detained by local authorities and is reportedly cooperating with the FBI to identify and locate remaining members of the hacking syndicate.

According to reports from KrebsOnSecurity, the suspect—who operates online under the hacker handle “Rey” and has been identified in investigative profiles as Saif Al-din Khader—was taken into custody just as the group was actively attempting to extort a newly divested business unit of global aerospace giant Boeing. This development marks a significant turning point in an international crackdown on the loosely structured, franchise-style cyber extortion ring that has plagued major corporations, educational institutions, and government agencies for years.

The timing of Khader’s apprehension has drawn intense scrutiny from global investigators due to his personal background. The business unit targeted in the extortion attempt was Jeppesen ForeFlight, a digital aviation navigation subsidiary that Boeing sold in late 2025. Intriguingly, open-source intelligence and digital forensic artifacts indicate that Rey’s father is employed by Royal Jordanian Airlines, a carrier largely controlled by the Jordanian government that relies heavily on a long-haul fleet of passenger aircraft manufactured by Boeing. While investigators have explored the domestic implications of this connection, the primary focus remains on Khader’s digital footprint and his role in managing the ShinyHunters brand through a tumultuous period of international law enforcement pressure.

The Anatomy of an Arrest and a Coordinated Crackdown

The enforcement action in Amman follows a series of dramatic international moves against individuals linked to the ShinyHunters ecosystem. On October 3, Reuters cited three anonymous sources confirming that Jordanian authorities had detained Khader and that he was actively assisting the FBI. This aligned closely with a November 2025 profile published by KrebsOnSecurity, which first identified Rey and highlighted his admissions regarding work with multiple ransomware syndicates.

The pressure on Khader intensified following a September 28 exclusive report detailing the arrest of 24-year-old Dutch cybercriminal Pepijn van der Stap. Dutch police detained Van der Stap on the evening of September 15 during a high-profile raid in Amsterdam that reportedly involved the use of flash-bang grenades. Prosecutors allege that Van der Stap aided in data thefts and extortions orchestrated by ShinyHunters, building on a prior criminal history that previously netted him a multi-year prison sentence.

Immediately following Van der Stap’s arrest, Rey aggressively moved to assert control over the ShinyHunters brand. Utilizing his long-standing accounts on Twitter/X, Rey publicly boasted about compromising highly sensitive data belonging to the FBI and extorting the notorious Cl0p ransomware group. In an apparent attempt to divert suspicion and frame others, Rey taunted both law enforcement and rival cybercriminals by posting memes that incorporated the avatar of “Umbreon,” an online alias previously used by Van der Stap.

Exploiting Oracle PeopleSoft and Targeting the FBI

The operational backbone of ShinyHunters’ recent wave of attacks relied on the mass exploitation of a critical software vulnerability (CVE-2026-35273) affecting PeopleSoft, an enterprise software-as-a-service platform developed by Oracle. Widely utilized by organizations across industries for human resources, payroll, and hiring management, the PeopleSoft vulnerability was first leveraged as a zero-day by ShinyHunters in June.

Although Oracle moved swiftly to issue security patches and security firms like Mandiant released temporary web application firewall (WAF) mitigation rules, the hackers adapted their tactics. By employing well-known URL-encoding tricks to bypass Mandiant’s suggested firewall rules, the group managed to compromise dozens of systems across higher education, healthcare, technology, agriculture, transportation, and government sectors. Security experts from Mandiant and the Google Threat Intelligence Group (GTIG) confirmed the scale of the campaign in a late September joint report.

The group’s ambitions infamously extended to the FBI itself. According to statements made by the hackers to technology publication BleepingComputer, the initial goal of exploiting the PeopleSoft flaw was to breach the bureau’s internal recruitment database. While those initial efforts faced hurdles, subsequent breaches successfully exposed sensitive data belonging to more than 5,000 FBI personnel, including specialized unit assignments, medical files, and psychiatric records. The fallout prompted the FBI to remove an Accenture contractor responsible for maintaining the compromised recruitment portal due to a failure to apply critical security patches.

"Rey" Means King, as in Royal

As investigative details surrounding Khader’s arrest emerged, sources familiar with the inquiry revealed that ShinyHunters was deeply engaged in an extortion attempt against a divested Boeing unit at the moment of the raid. The investigation gained emergency momentum because the stolen data from the former Boeing subsidiary—identified by Boeing as Jeppesen ForeFlight, which was sold to private equity firm Thoma Bravo for $10.55 billion—posed potential operational safety and security risks.

Boeing acknowledged the extortion threats in a statement, noting that it was actively reviewing the claims alongside the Jeppesen ForeFlight team. Jeppesen ForeFlight representatives maintained that an internal investigation revealed no operational or product impact stemming from the incident.

Khader’s connection to the aviation sector drew further attention due to evidence linking his family to Royal Jordanian Airlines. Password-stealing malware recovered from a shared family computer previously showed that Khader’s father utilized credentials that mapped directly to employee portals for the airline. Although neither Khader nor his father responded to multiple requests for comment, digital records show that within hours of a final media inquiry being sent to the family home, Rey began systematically purging his social media footprint, including the accounts used to taunt the FBI and Cl0p.

Despite deleting his mainstream social profile accounts, a technical blog maintained by Rey on GitHub remained accessible. The blog featured an extensive investigative post published in March 2026 that attempted to dox two Russian individuals alleged to be the core developers and operators behind the Cl0p ransomware platform.

Broader Allegations and the "Franchising" of Cybercrime

While Khader faces interrogation and potential prosecution in Jordan, legal proceedings in the Netherlands have uncovered explosive separate allegations against Pepijn van der Stap. Dutch daily newspaper RTL reported that investigators suspect Van der Stap of attempting to orchestrate at least two murders abroad. Following his release from a prison sentence related to earlier cybercrimes, Van der Stap had publicly cultivated a persona as a reformed hacker, recently securing employment as an "offensive security lead" at a Dutch cybersecurity firm named Neo Security. Following his September 15 arrest, Neo Security management initiated independent forensic audits, though initial reviews reportedly found no evidence that Van der Stap compromised his employer or clients.

Security analysts emphasize that the modern incarnation of ShinyHunters bears little resemblance to its original founders, most of whom were French citizens apprehended in prior international sweeps. Instead, the group has evolved into a franchise model akin to a digital "Dread Pirate Roberts," where successful cybercriminal brands are continually inherited, bought, or usurped by new generations of freelance hackers and extortionists.

In underground chat servers on Telegram, community members openly mocked Rey for attempting to resurrect a burnt brand, accusing him of purchasing old PGP keys and forum credentials to run a proxy extortion service. According to competing cybercrime monitors, Khader allegedly collaborated with small cliques of online associates to negotiate data ransoms under the ShinyHunters alias, taking a cut of the proceeds while causing millions of dollars in cumulative corporate damage.

The group’s public posturing had reached a fever pitch in May 2026, when the FBI issued a public flash notice advising organizations against paying ransoms to ShinyHunters and warning of harassment tactics such as swatting and intimidation. In interviews with industry reporters, ShinyHunters leadership cynically admitted that their subsequent decision to hack the FBI was driven primarily by public relations and marketing objectives designed to undermine the agency’s credibility and salvage their extortion business model. With key figures now detained in both the Middle East and Europe, the future of the decentralized franchise remains uncertain as international law enforcement continues to untangle its network of global affiliates.