{"id":930,"date":"2026-10-07T22:17:26","date_gmt":"2026-10-07T22:17:26","guid":{"rendered":"https:\/\/smartcryptosecurity.com\/?p=930"},"modified":"2026-10-07T22:17:26","modified_gmt":"2026-10-07T22:17:26","slug":"alleged-leader-of-shinyhunters-detained-in-jordan-and-cooperating-with-fbi-following-high-stakes-extortion-case","status":"publish","type":"post","link":"https:\/\/smartcryptosecurity.com\/?p=930","title":{"rendered":"Alleged Leader of ShinyHunters Detained in Jordan and Cooperating with FBI Following High-Stakes Extortion Case"},"content":{"rendered":"

A teenager from Amman, Jordan, suspected of orchestrating high-profile data thefts and leading the prolific extortion collective known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the FBI to identify other members of the hacking syndicate. <\/p>\n

According to investigative reporting by KrebsOnSecurity, the suspect\u2014who operates online under the hacker handle \u201cRey\u201d\u2014was taken into custody just as the decentralized cybercrime ring was actively attempting to extort a newly divested business unit of global aerospace giant Boeing. In a striking convergence of cyber intrusions and personal ties, the target of the group’s latest extortion plot was Jeppesen ForeFlight, a navigation and digital aviation unit. This development drew immediate attention because the targeted firm shares indirect aerospace connections with the employer of Rey\u2019s father, who works for Royal Jordanian Airlines, an enterprise largely controlled by the Jordanian government and operating a long-haul fleet built primarily by Boeing.<\/p>\n

The detention of the suspect, identified by international media and independent researchers as Saif Al-din Khader, marks a significant turning point in the global crackdown against modern ransomware affiliates and data extortionists. On October 3, Reuters cited three unnamed sources confirming that an individual named Saif Al-din Khader had been detained in Amman and was actively assisting the FBI. This aligned directly with prior investigative work by KrebsOnSecurity, which profiled Khader in November 2025, detailing his admissions of working alongside multiple ransomware syndicates under the moniker Rey.<\/p>\n

The net has been tightening around the ecosystem of hackers associated with the ShinyHunters brand for months. Rey was featured prominently in a September 28 exclusive detailing the arrest of 24-year-old convicted cybercriminal Pepijn van der Stap by Dutch police. Van der Stap, a Dutch national, was suspected of aiding and abetting data thefts and extortion campaigns orchestrated by ShinyHunters. <\/p>\n

Immediately following the Dutchman\u2019s dramatic arrest on the evening of September 15\u2014which involved special police units and flash-bang grenades in Amsterdam\u2014Rey brazenly assumed control over the ShinyHunters brand. Capitalizing on the sudden vacuum, the Jordanian teenager began publicly boasting about stealing highly sensitive data from the FBI and attempting to extort the notoriously ruthless ransomware group known as Cl0p.<\/p>\n

\"ShinyHunters<\/figure>\n

In a display of youthful bravado, Rey taunted both federal law enforcement and the Cl0p ransomware operators using memes uploaded to his longtime account on Twitter\/X. At the same time, he deliberately embedded images of the avatar used by Van der Stap\u2019s former hacker alias, \u201cUmbreon,\u201d in an apparent false-flag operation designed to pin the blame for the high-level hacks directly on the imprisoned Dutchman.<\/p>\n

The Oracle PeopleSoft Campaign and the FBI Breach<\/h2>\n

The recent wave of activity tied to the ShinyHunters moniker relied heavily on a critical software vulnerability. As security researchers detailed in late September, the threat actors gained unauthorized access to the FBI\u2019s recruitment portal and dozens of other corporate and governmental systems by exploiting a zero-day vulnerability, tracked as CVE-2026-35273, in Oracle PeopleSoft. <\/p>\n

PeopleSoft is a widely utilized software-as-a-service (SaaS) platform deployed globally by major enterprises, universities, and government agencies to manage human resources, payroll, recruitment, and benefits administration. Oracle moved swiftly to issue a security patch after ShinyHunters began weaponizing the vulnerability in June. Around the same time, cybersecurity firm Mandiant released specialized web application firewall (WAF) rules to help organizations protect environments that could not be patched immediately.<\/p>\n

While initial attempts by ShinyHunters in June targeted the FBI’s own internal PeopleSoft database without immediate success, the group later bypassed Mandiant’s defensive firewall rules by employing a well-known URL-encoding trick. In a joint report released on September 25, analysts from Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that the threat actors had mass-exploited the PeopleSoft flaw. This campaign compromised sensitive data across a diverse array of sectors, including healthcare, higher education, technology, agriculture, transportation, and government institutions.<\/p>\n

The fallout from the breach of federal systems has been severe. Reuters reported on October 5 that the FBI terminated a contract with an external vendor, Accenture, following disclosures that a contractor failed to properly apply patches to the recruitment website. The resulting security lapse exposed deeply sensitive personal and professional data belonging to more than 5,000 FBI personnel, including specific unit assignments, operational specializations, and confidential medical and psychiatric records.<\/p>\n

\"ShinyHunters<\/figure>\n

"Rey" Means King, As in Royal<\/h2>\n

According to sources close to the international investigation, the FBI\u2019s pursuit of the ShinyHunters network gained frantic momentum when the group turned its sights on Jeppesen ForeFlight. The navigation and aviation subsidiary had only recently been divested by Boeing, which sold the unit in November 2025 to private equity firm Thoma Bravo for $10.55 billion. Investigators noted that the data stolen from the former Boeing subsidiary posed unique operational safety and security concerns, accelerating law enforcement actions overseas.<\/p>\n

Boeing formally acknowledged the extortion attempts in a statement provided to security researchers, confirming that the incident involved data allegedly stolen from Jeppesen ForeFlight. A Boeing spokesperson noted that the company was actively reviewing the matter alongside leadership at the subsidiary. Meanwhile, representatives for Jeppesen ForeFlight maintained that an internal review found no adverse effects on ongoing operations or product safety, pointing to a proactive security posture.<\/p>\n

The nexus between Rey\u2019s cybercriminal exploits and his familial background has drawn intense scrutiny from analysts. Evidence previously uncovered by KrebsOnSecurity indicates that Rey\u2019s father utilized credentials that were compromised by password-stealing malware on a shared family computer, logging into multiple administrative portals for Royal Jordanian Airlines. Although initial claims on Telegram suggested his father was an airline pilot\u2014a detail that could not be independently verified\u2014the family’s digital footprint remained intertwined with the aviation sector.<\/p>\n

When KrebsOnSecurity contacted Rey\u2019s father ahead of the September 28 expos\u00e9 to apprise him of his son\u2019s activities, neither family member responded. However, the impact of the outreach was instantaneous: within hours of the inquiry, Rey began rapidly scrubbing his digital footprint, deleting numerous social media profiles, including the Twitter\/X account used to mock federal agents and corporate victims.<\/p>\n

Despite purging his primary social accounts, Rey’s technical blog hosted on GitHub remained active. The technical writings revealed an obsessive focus on the inner workings of rival cybercriminal outfits, highlighted by an extensive March post that successfully doxed two Russian nationals identified as the core developers behind the Cl0p ransomware enterprise.<\/p>\n

\"ShinyHunters<\/figure>\n

Murder-for-Hire Allegations in the Netherlands<\/h2>\n

While developments unfolded in Amman, Dutch media outlets brought to light explosive new allegations regarding Pepijn van der Stap, whose narrative of personal rehabilitation had previously captivated the cybersecurity industry. On September 29, Dutch daily RTL reported that investigators suspect Van der Stap of attempting to orchestrate at least two murders to be carried out abroad, pointing to indications that he gave direct orders for the fatal attacks.<\/p>\n

Van der Stap had recently returned to civilian life after serving the majority of a four-year prison sentence for extensive data theft and extortion operations that prosecutors estimated netted between 1.5 million and 2.7 million euros. Prior to his September 15 arrest, Van der Stap had secured employment as an "offensive security lead" at Neo Security, an Amsterdam-based cybersecurity firm, where he claimed his daily duties involved vulnerability testing for corporate clients.<\/p>\n

Benjamin Korper, the owner of Neo Security, told Reuters that an independent auditing firm was promptly hired to investigate whether Van der Stap had compromised the agency or its clients. Investigators reported finding no evidence that Van der Stap had weaponized his position against his employer. Korper recalled the shock of the police raid on September 15, which involved tactical intervention units deploying flash-bang grenades at the suspect’s residence.<\/p>\n

Before his initial legal troubles in 2023, Van der Stap maintained a dual existence as a software engineer for an Amsterdam security startup and a volunteer for the Dutch Institute for Vulnerability Disclosure (DIVD), even as he covertly breached corporate networks. Confronted in an interview regarding the inherent difficulties of trusting a convicted extortionist who had deceived colleagues and journalists alike, Van der Stap maintained that his technical contributions would ultimately define his legacy. <\/p>\n

Franchising and Burning a Brand<\/h2>\n

Security experts emphasize that the modern incarnation of ShinyHunters bears little resemblance to the original collective of French citizens who launched high-profile data thefts dating back to 2019, most of whom have long since faced arrest and imprisonment. Instead, the ShinyHunters name has evolved into a franchise model akin to the legendary "Dread Pirate Roberts" archetype, where succession is determined by law enforcement interventions rather than death, and multiple operators can claim the mantle simultaneously.<\/p>\n

\"ShinyHunters<\/figure>\n

Federal investigators are increasingly focusing on a decentralized network of freelance cybercriminals and affiliates. These individuals trade unauthorized access credentials to enterprise SaaS platforms in exchange for a percentage of any extortion payments wrung from victim organizations.<\/p>\n

Following the news of Van der Stap\u2019s arrest and the subsequent takedown of the group’s darknet infrastructure, specialized chat channels on Telegram erupted with criticism directed at Rey. Cybercrime commentators accused the teenage hacker of co-opting a battered brand name to posture as an elite cybercriminal, damaging the syndicate’s reputation through erratic extortion attempts. <\/p>\n

"He bought the old forum PGP key and used it to make new Breachforum websites and Telegram channels larping as ShinyHunters to ransom companies and then sell the used data," one community member observed.<\/p>\n

A dedicated monitoring channel on Telegram known as "The Battle" relentlessly doxed and ridiculed Rey and his associates, framing the young hacker as an inexperienced opportunist attempting to ride the coattails of a notorious brand. Administrators of the channel alleged that Rey was responsible for over $200 million in cumulative damages, operating alongside small factions that leveraged the ShinyHunters alias to negotiate ransoms in exchange for a fractional cut of the illicit proceeds.<\/p>\n

The group’s decision to target federal law enforcement earlier in the year stemmed from public relations friction. Following an advisory issued by the FBI and the Internet Crime Complaint Center (IC3) in May 2026\u2014which warned organizations against paying ransom and detailed harassment tactics such as swatting and threatening phone calls\u2014ShinyHunters claimed they breached federal servers simply to counter the agency’s narrative. In interviews with specialized tech publications, the hackers admitted that the FBI\u2019s public warnings severely hampered their ability to convince victims to pay, transforming their digital intrusions into an aggressive marketing campaign to protect their bottom line.<\/p>\n","protected":false},"excerpt":{"rendered":"

A teenager from Amman, Jordan, suspected of orchestrating high-profile data thefts and leading the prolific…<\/p>\n","protected":false},"author":8,"featured_media":929,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[142],"tags":[392,1076,1037,143,146,172,828,363,144,83,173,226,169,1075,145],"class_list":["post-930","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-news","tag-alleged","tag-case","tag-cooperating","tag-cybersecurity","tag-defense","tag-detained","tag-extortion","tag-following","tag-hacking","tag-high","tag-jordan","tag-leader","tag-shinyhunters","tag-stakes","tag-threats"],"_links":{"self":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/930","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=930"}],"version-history":[{"count":0,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/930\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/media\/929"}],"wp:attachment":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=930"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=930"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=930"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}