{"id":1036,"date":"2026-10-08T22:17:13","date_gmt":"2026-10-08T22:17:13","guid":{"rendered":"https:\/\/smartcryptosecurity.com\/?p=1036"},"modified":"2026-10-08T22:17:13","modified_gmt":"2026-10-08T22:17:13","slug":"suspected-leader-of-shinyhunters-cyber-extortion-group-detained-in-jordan-and-cooperating-with-the-fbi","status":"publish","type":"post","link":"https:\/\/smartcryptosecurity.com\/?p=1036","title":{"rendered":"Suspected Leader of ShinyHunters Cyber Extortion Group Detained in Jordan and Cooperating With the FBI"},"content":{"rendered":"

A teenager based in Amman, Jordan, suspected of acting as a central figure behind the notorious data theft and extortion collective known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the FBI to identify other members of the hacking syndicate. <\/p>\n

According to investigative reporting by KrebsOnSecurity, the suspect\u2014who operates online under the hacker handle \u201cRey\u201d\u2014was taken into custody just as the group was actively attempting to extort a business unit recently divested by global aerospace giant Boeing. In a striking coincidence underscoring the interconnected nature of modern cybercrime investigations, the target of the extortion was Jeppesen ForeFlight, while the suspect’s own father is employed by Royal Jordanian Airlines, a carrier that operates long-haul fleets composed of Boeing aircraft.<\/p>\n

The detention follows reports from Reuters, which cited three unnamed sources confirming that a suspected ShinyHunters member in Amman named Saif Al-din Khader had been detained by Jordanian law enforcement and was actively assisting the FBI. KrebsOnSecurity previously identified Rey as Khader in a detailed profile published in November 2025, during which the young man admitted to collaborating with multiple ransomware operations.<\/p>\n

Rey\u2019s activities drew renewed scrutiny following a September 28 exclusive regarding the arrest of 24-year-old Dutch cybercriminal Pepijn van der Stap by Dutch police on suspicion of aiding ShinyHunters’ data thefts and extortion campaigns. Investigators noted that immediately following the Dutch suspect’s arrest on the evening of September 15, Rey assumed operational control over the ShinyHunters brand. He quickly began boasting publicly about stealing sensitive data from the FBI and extorting the rival ransomware group Cl0p.<\/p>\n

\"ShinyHunters<\/figure>\n

In an effort to deflect attention and frame others, Rey taunted both federal law enforcement and the Cl0p syndicate using memes posted to his established Twitter\/X account. These posts prominently featured the avatar associated with Van der Stap\u2019s former hacker alias, \u201cUmbreon,\u201d in a transparent attempt to implicate the Dutch national in the high-profile hacks.<\/p>\n

The breaches executed by ShinyHunters and its affiliates relied heavily on the mass exploitation of a zero-day vulnerability, designated as CVE-2026-35273, affecting PeopleSoft\u2014a software-as-a-service platform developed by Oracle and widely utilized across corporate and government sectors for human resources, payroll, and benefits management. Although Oracle moved quickly to issue a security patch after the vulnerability began seeing active exploitation in June, and Mandiant subsequently released web application firewall rules for organizations unable to apply patches immediately, the hackers continued their campaign. <\/p>\n

Initially, ShinyHunters indicated to industry media that their primary objective in targeting the PeopleSoft vulnerability was to breach the FBI\u2019s internal database, though those early attempts were reportedly unsuccessful. In subsequent weeks, however, the group bypassed protective firewall rules by employing a familiar URL-encoding trick. <\/p>\n

A joint threat intelligence report released by Mandiant and the Google Threat Intelligence Group confirmed that the syndicate had mass-exploited the vulnerability to compromise data across numerous sectors, including healthcare, technology, higher education, agriculture, transportation, and government agencies. Subsequent investigative reports revealed that the FBI was forced to remove an Accenture contractor over failures to patch the specific recruitment portal exploited by the hackers, an incident that exposed sensitive records pertaining to more than 5,000 bureau personnel, including unit specializations alongside medical and psychiatric information.<\/p>\n

\u201cRey\u201d Means King, as in Royal<\/strong><\/p>\n

\"ShinyHunters<\/figure>\n

Sources familiar with the ongoing international investigation confirmed that the digital aviation navigation unit recently divested by Boeing was squarely in the crosshairs of ShinyHunters’ extortion efforts at the time of Rey’s apprehension. The attempt to extort the former Boeing subsidiary significantly heightened the urgency of the FBI\u2019s probe, given that the stolen data possessed the potential to introduce genuine operational safety and security risks.<\/p>\n

In a brief statement addressing the incident, Boeing acknowledged the extortion attempts directed against data originating from Jeppesen ForeFlight, a subsidiary that Boeing sold to private equity firm Thoma Bravo for $10.55 billion in November 2025. A spokesperson for Boeing confirmed that the company was reviewing the claims alongside the Jeppesen ForeFlight team. Meanwhile, a representative for Jeppesen ForeFlight maintained that internal investigations and a robust security posture ensured there was no operational or product impact.<\/p>\n

The unfolding situation took a personal turn due to Rey’s familial ties. Evidence derived from a password-stealing malware infection on a shared family computer revealed that Rey\u2019s father utilized credentials that mapped directly to administrative portals for Royal Jordanian Airlines employees. Furthermore, Rey had previously claimed on Telegram that his father worked as an airline pilot. <\/p>\n

When contacted by investigative journalists prior to the publication of these findings, neither Rey nor his family responded directly. However, within hours of outreach directed at his father, Rey initiated a sweeping purge of his online presence, deleting multiple social media profiles, including the Twitter\/X account previously used to taunt law enforcement and victimized corporations. <\/p>\n

Despite deleting his social media footprint, a cybersecurity blog maintained by Rey on GitHub remained active, highlighting an ongoing obsession with the leadership of the Cl0p ransomware operation. A lengthy post published on the blog in March 2026 attempted to dox two Russian men alleged to be the core developers and masterminds behind Cl0p.<\/p>\n

\"ShinyHunters<\/figure>\n

Murder for Hire Allegations<\/strong><\/p>\n

Meanwhile, legal proceedings in the Netherlands introduced startling new allegations against Pepijn van der Stap, whose narrative of personal rehabilitation and transition into legitimate cybersecurity work had previously received considerable media attention. Dutch daily newspaper RTL reported that investigators suspect Van der Stap attempted to commission at least two murders abroad.<\/p>\n

Van der Stap had earlier served the majority of a four-year prison sentence for extortion and data theft offenses that prosecutors estimated netted between 1.5 million and 2.7 million euros. Following his release, he secured employment as an offensive security lead at Amsterdam-based Neo Security, where his responsibilities ostensibly involved vulnerability testing for clients. <\/p>\n

Following Van der Stap’s dramatic arrest on September 15\u2014which reportedly involved Dutch special units deploying flash-bang grenades\u2014Neo Security’s owner stated that an independent firm was hired to audit company networks. Thus far, investigators have found no evidence that Van der Stap compromised his employer or its clientele. Prior to his initial 2023 conviction, Van der Stap had worked as a software engineer at a local security startup while volunteering with the Dutch Institute for Vulnerability Disclosure, all while participating in extortion schemes targeting major entities.<\/p>\n

Franchising and Burning a Brand<\/strong><\/p>\n

\"ShinyHunters<\/figure>\n

Cybersecurity researchers note that the individuals operating under the ShinyHunters banner today represent a stark departure from the group’s original core members, most of whom are French nationals who have previously faced arrest and prosecution. Over the years, ShinyHunters has evolved into an informal franchise model. Much like the literary concept of the Dread Pirate Roberts, the collective operates less as a static organization and more as a brand inherited or adopted by successive waves of cybercriminals.<\/p>\n

Following the arrest of Van der Stap, chat servers on Telegram associated with Rey became arenas of internal conflict. Observers within the cybercrime underground heavily criticized Rey for attempting to resurrect a burnt brand, accusing him of purchasing old PGP keys and forum credentials to set up imitation leak sites and extort companies for personal financial gain.<\/p>\n

A competing Telegram monitoring channel dedicated to tracking the group asserted that Rey had leveraged the ShinyHunters identity to help various affiliate networks negotiate ransom payments in exchange for a cut of the proceeds. According to these community sources, Rey’s public antics and eventual collapse under law enforcement pressure brought unnecessary scrutiny to an already fractured criminal ecosystem.<\/p>\n

In statements provided to technology media outlets prior to these arrests, representatives of the hacking collective asserted that their high-profile targeting of federal agencies was designed to counter public warnings issued by authorities. While the group acknowledged that official advisories ultimately harmed their leverage by discouraging victim organizations from paying ransoms, their operations underscored the persistent vulnerability of corporate networks relying on legacy enterprise platforms. <\/p>\n

As international law enforcement agencies continue to dismantle the infrastructure supporting these extortion campaigns, the cooperation of key suspects like Khader highlights the fragility inherent in underground cybercriminal networks operating across borders.<\/p>\n","protected":false},"excerpt":{"rendered":"

A teenager based in Amman, Jordan, suspected of acting as a central figure behind the…<\/p>\n","protected":false},"author":1,"featured_media":1035,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[142],"tags":[1037,1054,143,146,172,828,176,144,173,226,169,1036,145],"class_list":["post-1036","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-news","tag-cooperating","tag-cyber","tag-cybersecurity","tag-defense","tag-detained","tag-extortion","tag-group","tag-hacking","tag-jordan","tag-leader","tag-shinyhunters","tag-suspected","tag-threats"],"_links":{"self":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/1036","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1036"}],"version-history":[{"count":0,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/1036\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/media\/1035"}],"wp:attachment":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1036"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1036"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1036"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}