{"id":1046,"date":"2026-10-09T06:04:17","date_gmt":"2026-10-09T06:04:17","guid":{"rendered":"https:\/\/smartcryptosecurity.com\/?p=1046"},"modified":"2026-10-09T06:04:17","modified_gmt":"2026-10-09T06:04:17","slug":"key-shinyhunters-suspect-detained-in-jordan-and-cooperating-with-the-fbi-sources-say","status":"publish","type":"post","link":"https:\/\/smartcryptosecurity.com\/?p=1046","title":{"rendered":"Key ShinyHunters Suspect Detained in Jordan and Cooperating With the FBI, Sources Say"},"content":{"rendered":"

A teenager from Amman, Jordan, suspected of acting as a leading figure in the prolific and aggressive data theft and extortion collective known as ShinyHunters<\/strong>, has been detained by local authorities and is reportedly cooperating with the Federal Bureau of Investigation (FBI) to help identify other members of the hacking syndicate. <\/p>\n

According to investigative reporting by KrebsOnSecurity, the suspect\u2014who operates in cybercrime circles under the handle \u201cRey<\/strong>\u201d\u2014was taken into custody just as ShinyHunters was actively attempting to extort a business unit recently divested by global aerospace giant Boeing<\/strong>. Intriguingly, the manufacturing conglomerate builds the exact fleet of commercial aircraft utilized by Royal Jordanian Airlines<\/strong>, the employer of Rey\u2019s father.<\/p>\n

The Arrest and the Investigation<\/h2>\n

On October 3, Reuters cited three unnamed sources confirming that a suspected ShinyHunters member in Amman named Saif Al-din Khader<\/strong> had been detained by Jordanian authorities and was actively assisting the FBI. KrebsOnSecurity previously identified Rey as Khader in a November 2025 investigative profile, in which the young man openly admitted to collaborating with multiple ransomware operations.<\/p>\n

Rey\u2019s name surfaced prominently once again in a September 28 exclusive detailing the Dutch police arrest of 24-year-old convicted cybercriminal Pepijn van der Stap<\/strong>. Van der Stap was apprehended on suspicion of facilitating data thefts and extortions on behalf of ShinyHunters. Investigators noted that immediately following the Dutchman\u2019s dramatic arrest on the evening of September 15, Rey seized operational control of the ShinyHunters brand. From there, he began publicly boasting about stealing highly sensitive data from the FBI<\/strong> and attempting to extort the rival ransomware group Cl0p<\/strong>.<\/p>\n

Using his longtime account on Twitter\/X, Rey taunted both federal law enforcement and the Cl0p ransomware operators with a series of memes. At the same time, he strategically incorporated images of the avatar utilized by Van der Stap\u2019s former hacking alias, \u201cUmbreon<\/strong>,\u201d in what appeared to be a calculated maneuver to frame the Dutchman for the fresh wave of high-profile cyberattacks.<\/p>\n

\"ShinyHunters<\/figure>\n

The initial wave of intrusions carried out by ShinyHunters relied heavily on exploiting a critical software vulnerability, tracked as CVE-2026-35273, within PeopleSoft<\/strong>. The software-as-a-service platform, developed by tech titan Oracle<\/strong>, is widely implemented across global enterprises for managing human resources, payroll, recruitment, and employee benefits. Although Oracle rapidly issued a security patch after ShinyHunters began exploiting the flaw as a zero-day vulnerability in June, organizations struggled to apply the updates universally. Cybersecurity firm Mandiant subsequently released web application firewall (WAF) rules to shield vulnerable networks.<\/p>\n

Despite these defensive measures, security experts with Mandiant and the Google Threat Intelligence Group (GTIG) confirmed in a September 25 threat report that ShinyHunters had deployed a well-known URL-encoding bypass trick to circumvent Mandiant\u2019s WAF rules. This mass-exploitation campaign targeted dozens of organizations across higher education, technology, healthcare, agriculture, transportation, and government sectors. BleepingComputer reported in June that the group’s original objective was to infiltrate the FBI\u2019s own PeopleSoft database\u2014an attempt that initially stalled before the hackers pivoted to wider enterprise exploitation.<\/p>\n

Further fallout from the campaign materialized when Reuters reported that the FBI removed an Accenture<\/strong> contractor following a damaging data breach. The contractor had reportedly failed to patch the specific FBI recruitment portal compromised by the hacking collective, exposing sensitive personal and professional details of more than 5,000 FBI personnel, including individual specializations, unit assignments, and confidential medical and psychiatric records.<\/p>\n

\u2018Rey\u2019 Means King, as in Royal<\/h2>\n

As details surrounding the crackdown on the group emerged, two sources familiar with the ongoing international investigation revealed that a navigation and digital aviation unit recently divested by Boeing<\/strong> was squarely in the crosshairs of ShinyHunters when Rey was captured in Amman. The attempted extortion of the former Boeing division introduced a new level of urgency to the FBI\u2019s investigation, particularly because the stolen data allegedly posed distinct operational safety and security risks.<\/p>\n

In a brief statement provided to KrebsOnSecurity, Boeing acknowledged the extortion attempts directed against its former subsidiary, Jeppesen ForeFlight<\/strong>, which Boeing sold to private equity firm Thoma Bravo for $10.55 billion in November 2025. <\/p>\n

\"ShinyHunters<\/figure>\n

\u201cWe are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight,\u201d a Boeing spokesperson stated. \u201cWe are actively reviewing the matter with the Jeppesen ForeFlight team.\u201d<\/p>\n

Representatives for Jeppesen ForeFlight maintained that their internal defenses successfully mitigated any tangible disruption. A spokesperson stated that based on their ongoing investigation and proactive security posture, there was no operational impact on their products or services.<\/p>\n

Rey\u2019s alleged role in targeting the former Boeing subsidiary draws added scrutiny given evidence linking his father to Royal Jordanian Airlines<\/strong>, a government-controlled carrier that relies on passenger aircraft manufactured by Boeing. While Rey claimed on Telegram in early 2025 that his father worked as an airline pilot, that specific claim could not be independently verified. However, a prior analysis of a password-stealing malware infection on the family\u2019s shared computer revealed that Rey\u2019s father utilized identical credentials across multiple online employee portals for Royal Jordanian Airlines.<\/p>\n

Royal Jordanian Airlines did not immediately respond to requests for comment. Shortly after KrebsOnSecurity contacted Rey\u2019s father ahead of its late-September reporting to apprise him of his son’s cybercriminal activities, Rey began systematically purging his digital footprint, deleting numerous social media profiles and shutting down the Twitter\/X account he had used to taunt law enforcement and corporate victims.<\/p>\n

Despite scrubbing his social media presence, a cybersecurity blog maintained by Rey on GitHub remained active. The repository featured an in-depth investigative post from March 2026 that attempted to doxing two Russian nationals alleged to be the core developers and masterminds behind the Cl0p ransomware operation.<\/p>\n

\"ShinyHunters<\/figure>\n

Murder-for-Hire Allegations in the Netherlands<\/h2>\n

While authorities in the Middle East closed in on Rey, shocking new allegations surfaced in the Netherlands regarding Pepijn van der Stap, whose narrative of personal rehabilitation and transition into legitimate corporate cybersecurity had previously received widespread media attention. According to Dutch daily newspaper RTL, investigators suspect Van der Stap attempted to orchestrate at least two murders. Authorities indicate that the planned attacks were intended to take place abroad and that Van der Stap allegedly issued the direct orders for them.<\/p>\n

Van der Stap had recently completed the majority of a four-year prison sentence stemming from previous data theft and extortion convictions that prosecutors estimated netted between 1.5 million and 2.7 million euros. Following his release, he secured a position as an "offensive security lead" at Dutch cybersecurity firm Neo Security<\/strong>, where he claimed his responsibilities included testing client networks for security vulnerabilities.<\/p>\n

Neo Security owner Benjamin Korper informed Reuters that the firm retained an outside investigator to audit Van der Stap\u2019s activities and determine whether he had compromised Neo Security or any of its clients. Thus far, investigators have found no evidence of malicious activity directed against his employer. Korper added that Dutch forensic teams visited his corporate offices on September 15 during the dramatic police raid that resulted in Van der Stap\u2019s arrest, an operation that reportedly involved the use of flash-bang grenades.<\/p>\n

Before his initial 2023 arrest, Van der Stap worked as a software engineer at Amsterdam-based cybersecurity startup Hadrian while volunteering with the Dutch Institute for Vulnerability Disclosure (DIVD), even as he covertly orchestrated sophisticated extortion campaigns against major corporations. When questioned about how the public or victims could trust a self-proclaimed reformed hacker, Van der Stap maintained that his subsequent professional output had to speak for itself.<\/p>\n

"You can throw a bunch of nice words at someone, but you can\u2019t convince them if they don\u2019t want to be convinced," Van der Stap said in a September interview. "I\u2019m doing what I can to repay victims, and that\u2019s all I can do."<\/p>\n

\"ShinyHunters<\/figure>\n

Franchising and Burning a Brand<\/h2>\n

Security researchers point out that the individuals currently operating under the ShinyHunters banner are distinct from the group’s original core members\u2014most of whom are French citizens who have previously faced arrest and imprisonment for cybercrime. Over the years, ShinyHunters has evolved into a franchise model akin to the literary figure of the Dread Pirate Roberts, where succession is dictated by law enforcement arrests rather than death, allowing multiple individuals to adopt the mantle simultaneously.<\/p>\n

Federal investigators are reportedly focusing on a dwindling network of freelance affiliates who feed stolen SaaS platform credentials to the collective in exchange for a percentage of any eventual ransom payments extracted from corporate victims. In the wake of Van der Stap\u2019s arrest, chat servers on Telegram allegedly managed by Rey became scenes of intense backlash. Peers openly mocked the teenager after he backed down from public threats against the FBI and Cl0p, a retreat that coincided with the sudden offline status of the ShinyHunters darknet portal.<\/p>\n

Community commentators accused Rey of exploiting the legacy ShinyHunters brand for financial gain following the dismantling of the original group’s leadership. According to rival chat channels dedicated to tracking and doxing cybercriminals, Rey allegedly acquired old forum PGP keys and resurrected defunct infrastructure to orchestrate independent extortion schemes, netting a cut of negotiations while bringing unwanted scrutiny to the broader underground ecosystem.<\/p>\n

In an interview with The Register<\/em>, representatives for ShinyHunters asserted that their decision to target the FBI was a calculated public relations maneuver intended to counter a May 2026 public service announcement from the agency that warned victims against paying ransoms to the group. The FBI’s advisory highlighted the group\u2019s aggressive harassment tactics, which have ranged from harassing phone calls and text messages to targeted swatting incidents, as well as false claims regarding the possession of compromising personal media.<\/p>\n

While the hackers argued that their high-profile incursions demonstrated technical competence and pushed back against official warnings, security analysts emphasize that the relentless pressure from international law enforcement\u2014culminating in arrests in Amsterdam and Amman\u2014has severely disrupted the group\u2019s operations and degraded the commercial viability of its extortion franchise.<\/p>\n","protected":false},"excerpt":{"rendered":"

A teenager from Amman, Jordan, suspected of acting as a leading figure in the prolific…<\/p>\n","protected":false},"author":9,"featured_media":1045,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[198],"tags":[1037,146,172,173,184,205,169,204,1082,170],"class_list":["post-1046","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-phishing-social-engineering","tag-cooperating","tag-defense","tag-detained","tag-jordan","tag-phishing","tag-security-awareness","tag-shinyhunters","tag-social-engineering","tag-sources","tag-suspect"],"_links":{"self":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/1046","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1046"}],"version-history":[{"count":0,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/1046\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/media\/1045"}],"wp:attachment":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1046"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1046"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1046"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}