Alleged Leader of ShinyHunters Detained in Jordan and Cooperating With FBI, Sources Say

A teenager from Amman, Jordan, suspected of operating as a key leader of the prolific data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the Federal Bureau of Investigation (FBI) to identify other members of the hacking collective.

According to intelligence gathered by KrebsOnSecurity and corroborating reports from international news agencies, the suspect—who uses the online handle “Rey”—was taken into custody just as the group was deep into an aggressive extortion campaign targeting a recently divested business unit of global aerospace giant Boeing. In a striking twist of digital geography, the aerospace company manufactures the exact fleet of commercial aircraft utilized by the employer of Rey’s father, Royal Jordanian Airlines.

The international dragnet tightened on October 3, when Reuters cited three unnamed sources confirming that a suspected ShinyHunters member in Amman, identified as Saif Al-din Khader, had been detained by Jordanian authorities and was actively assisting the FBI. KrebsOnSecurity had previously unmasked Rey as Khader in a detailed profile published in November 2025, in which the young man candidly admitted to collaborating with multiple ransomware operations.

Rey’s name surfaced once more in a late-September exclusive detailing the arrest of 24-year-old Dutch cybercriminal Pepijn van der Stap by law enforcement in the Netherlands. Van der Stap, a convicted felon, was apprehended on suspicion of facilitating data thefts and extortions for ShinyHunters. Investigators noted that immediately following the Dutchman’s arrest on the evening of September 15, Rey seized control of the overarching ShinyHunters brand. Capitalizing on the chaos, he publicly boasted about breaching high-profile networks, including the FBI, and extorting the notorious ransomware cartel Cl0p.

To throw investigators off his trail, Rey taunted both the FBI and Cl0p through a series of mocking memes posted to his long-standing Twitter/X account. Alongside the taunts, he embedded images of the avatar utilized by Van der Stap’s former hacker alias, “Umbreon,” in an explicit attempt to frame the Dutch national for the fresh wave of attacks. However, this elaborate digital deception quickly unraveled as international law enforcement began connecting the dots between the operational infrastructure, chat logs, and the individuals behind the keyboard.

The security breaches orchestrated by ShinyHunters relied heavily on the mass exploitation of a critical security flaw, cataloged as CVE-2026-35273, affecting PeopleSoft. This software-as-a-service platform, developed by tech giant Oracle, is widely implemented across corporate environments worldwide to manage critical human resources functions, employee recruitment, payroll systems, and benefits administration. Oracle moved swiftly to issue a security patch after ShinyHunters began weaponizing the vulnerability as a zero-day exploit in June. Concurrently, cybersecurity firm Mandiant released specialized web application firewall (WAF) rules to protect organizations unable to immediately apply the software update.

Security disclosures revealed that the initial goal behind targeting PeopleSoft was breaching the FBI’s proprietary database, though those early attempts reportedly stalled. In the weeks leading up to Rey’s detention, however, the group bypassed Mandiant’s defensive safeguards by employing a well-documented URL-encoding trick. A joint threat intelligence report released by Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters successfully mass-exploited the PeopleSoft vulnerability to infiltrate and exfiltrate data from dozens of systems spanning diverse economic sectors, including higher education, healthcare, technology, agriculture, transportation, and government agencies.

The fallout from these intrusions proved severe. Subsequent reporting indicated that the FBI was forced to remove an Accenture contractor following a damaging data breach that compromised the bureau’s recruitment portal. The breach exposed sensitive personnel records belonging to more than 5,000 FBI employees, including specific details regarding individual specializations, assigned operational units, and confidential medical and psychiatric histories.

“Rey” Means King, as in Royal

As the investigation escalated, two independent sources familiar with the federal probe revealed that a specialized navigation and digital aviation unit divested by Boeing was directly targeted in the extortion plot that coincided with Rey’s arrest. The involvement of the former Boeing subsidiary added a layer of acute urgency to the FBI’s investigation, particularly given that the stolen data included proprietary material capable of posing tangible operational safety and security risks.

In an official statement shared regarding the incident, Boeing acknowledged the attempted extortion by the threat actors. The company confirmed that the targeted data originated from Jeppesen ForeFlight, a digital aviation subsidiary that Boeing sold to the private equity firm Thoma Bravo for $10.55 billion in November 2025.

“We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight,” a Boeing spokesperson stated, adding that the corporation was actively reviewing the situation alongside the subsidiary’s security teams. Jeppesen ForeFlight maintained that its internal investigation revealed zero adverse consequences for its day-to-day operations or commercial products.

The domestic context surrounding Rey’s cyber activities drew intense scrutiny from investigators. Strong evidence suggested that Rey’s father was employed by Royal Jordanian Airlines, a carrier majority-controlled by the Jordanian government that operates its long-haul routes using commercial aircraft designed and built by Boeing. While Rey claimed on Telegram channels in early 2025 that his father worked as an airline pilot, those assertions could not be independently verified.

Nevertheless, forensic analysis of a password-stealing malware infection on the Khader family’s shared computer revealed undeniable digital footprints. Data gathered by the malware demonstrated that Rey’s father routinely utilized identical login credentials across various official online portals designated for Royal Jordanian Airlines personnel.

Requests for comment sent to Royal Jordanian Airlines and Rey’s family went unanswered. However, the timeline of events suggests awareness of the closing net: shortly after KrebsOnSecurity reached out to Rey’s father with detailed questions regarding his son’s alleged cybercrimes, Rey began systematically purging his digital footprint, deleting multiple social media profiles, including the Twitter/X account used to mock federal law enforcement and corporate victims.

Despite the social media wipe, Rey’s technical blog hosted on GitHub survived the purge. The site featured a detailed investigative post published in March 2026 that attempted to expose the identities of two Russian men alleged to be the core developers and operators behind the Cl0p ransomware syndicate.

Murder-for-Hire Allegations Surface in the Netherlands

While investigators focused on the teenage suspect in Jordan, dramatic legal developments unfolded in the Netherlands regarding Pepijn van der Stap. The Dutch daily newspaper RTL reported that local authorities suspect Van der Stap attempted to orchestrate at least two murders overseas. Investigators uncovered indications that the former hacker, who had cultivated a public persona as a reformed cybercriminal, may have directly issued orders for these violent crimes.

Van der Stap’s public image had previously been praised in technology circles following his release from prison, where he served the majority of a four-year sentence for extorting companies and stealing data in a spree prosecutors estimated yielded between 1.5 million and 2.7 million euros. Following his release, he secured employment as an "offensive security lead" at Neo Security, a Dutch cybersecurity firm where he purportedly tested client network defenses.

Benjamin Korper, the owner of Neo Security, confirmed that an external auditing firm was retained to determine whether Van der Stap had compromised his employer or any firm clients, though initial reviews found no evidence of internal sabotage. Korper noted that Dutch forensic officers raided his office on September 15 during the high-profile police operation that resulted in Van der Stap’s arrest.

Prior to his initial 2023 conviction, Van der Stap maintained a dual life, working as a software engineer for an Amsterdam-based cybersecurity startup while volunteering for the Dutch Institute for Vulnerability Disclosure—all while secretly breaching corporate networks. When questioned about his deception prior to his latest arrest, Van der Stap maintained that his remediation efforts spoke for themselves.

Franchising and Burning a Brand

Cybersecurity researchers emphasize that the individuals currently operating under the banner of ShinyHunters do not represent the original core membership of the group, which first emerged around 2019 and was largely composed of French nationals who have since faced criminal prosecution and imprisonment. Instead, the modern iteration of ShinyHunters operates more like a decentralized franchise.

Security analysts compare the group’s succession model to the fictional "Dread Pirate Roberts" from popular culture, where the persona persists through a continuous cycle of arrests and replacements by freelance affiliates. Investigators note that contemporary cybercriminals frequently buy or inherit established dark-web forum credentials, PGP keys, and brand names to lend immediate credibility to their own data-extortion schemes.

In the wake of Van der Stap’s arrest, underground Telegram channels used by cybercriminals became hotbeds of criticism directed at Rey. Commentators accused the teenager of amateurishly hijacking the ShinyHunters moniker to launch extortion plots and peddle stolen corporate data for personal profit, ultimately drawing unwanted law enforcement attention to the broader underground community. A dedicated channel known as "The Battle" repeatedly targeted Rey, documenting his activities and characterizing him as a greenhorn who attempted to exploit a legendary cybercrime brand for financial gain.

The group’s high-profile exploits culminated in a direct confrontation with federal authorities. Following an advisory bulletin published by the FBI in May 2026 warning organizations against yielding to ransom demands, ShinyHunters retaliated by targeting the bureau’s recruitment infrastructure. Representatives for the hacking collective claimed the attack was designed to undermine public trust in official security warnings and serve as a marketing maneuver to bolster their leverage in ongoing extortion negotiations.

Despite these defiant public postures, the combined pressure of international police cooperation, rapid corporate patching, and the systematic dismantling of underlying infrastructure has severely degraded the group’s operational capacity, leaving its remaining affiliates scrambling as law enforcement closes in.