A teenager from Amman, Jordan, suspected of acting as a key leader for the prolific and destructive data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities. According to intelligence and investigative sources, the suspect is currently cooperating with the Federal Bureau of Investigation (FBI) to help identify and track down other active members of the hacking collective.
Investigative reporting from KrebsOnSecurity has identified the detained suspect as Saif Al-din Khader, who operated within cybercrime circles under the hacker handle “Rey.” Khader was first profiled in late 2025 after admitting involvement with multiple ransomware and extortion groups. The detention occurred while ShinyHunters was actively engaged in an aggressive extortion campaign targeting a business unit recently divested by global aerospace giant Boeing—a company whose fleet is heavily utilized by Royal Jordanian Airlines, the employer of Rey’s father.
The international dragnet tightening around ShinyHunters has unfolded rapidly over recent weeks. On October 3, Reuters cited three anonymous sources confirming that Khader had been taken into custody in Jordan and was assisting federal investigators. This development closely followed a September 28 exclusive report detailing the arrest of 24-year-old Dutch cybercriminal Pepijn van der Stap by law enforcement in the Netherlands. Van der Stap, a convicted felon, is suspected of providing crucial technical assistance for data thefts and extortion operations carried out under the ShinyHunters banner.
Following Van der Stap’s dramatic arrest on the evening of September 15—which reportedly involved local tactical units deploying flash-bang grenades—Rey seized control of the remnants of the ShinyHunters brand. Operating from Amman, the teenager publicly boasted about orchestrating high-profile data breaches, including targeting the FBI and attempting to extort the notorious ransomware syndicate Cl0p.
In an effort to throw investigators off his trail, Rey taunted both federal agents and Cl0p operators through a series of mocking memes posted to his long-standing Twitter/X account. These posts prominently featured the avatar of “Umbreon,” the former hacker alias used by Van der Stap, in a transparent attempt to frame the Dutch national for the fresh wave of attacks.
The PeopleSoft Vulnerability and the FBI Breach
The recent spike in activity by ShinyHunters was fueled by the mass exploitation of a critical security flaw (tracked as CVE-2026-35273) in PeopleSoft, an enterprise software-as-a-service platform developed by Oracle. Widely utilized across the corporate and government sectors for managing human resources, recruitment, payroll, and employee benefits, PeopleSoft servers became a prime target when the zero-day vulnerability began seeing active exploitation in June.
Although Oracle rapidly deployed a security patch and threat intelligence firms such as Mandiant issued temporary web application firewall (WAF) rules, the hackers adapted. After initial attempts to breach the FBI’s own PeopleSoft databases proved unsuccessful, ShinyHunters pivoted in subsequent weeks. Using a well-known URL-encoding trick, the threat actors successfully bypassed Mandiant’s defensive rules to infiltrate corporate and government networks.
In a joint threat intelligence report published on September 25, security experts at Mandiant and the Google Threat Intelligence Group confirmed that ShinyHunters leveraged the PeopleSoft exploit to compromise dozens of systems across diverse industries. The affected sectors included higher education, technology, healthcare, agriculture, transportation, and government agencies.
The operational fallout proved severe. Reuters reported that the FBI was forced to remove an Accenture contractor following a damaging data breach on the bureau’s recruitment website. That intrusion exposed sensitive information concerning more than 5,000 FBI personnel, including individual unit assignments, professional specializations, and confidential medical and psychiatric records.
"Rey" Means King, As In Royal
According to sources close to the international investigation, the FBI’s pursuit of ShinyHunters gained intense momentum when the group attempted to extort a navigation and digital aviation unit recently spun off from Boeing. Investigators feared that the exfiltrated data involved sensitive proprietary systems that could introduce significant operational safety and security risks to aviation infrastructure.
In a brief statement provided to investigators and media outlets, Boeing acknowledged the extortion attempts. The company confirmed that the threat actors claimed to hold data stolen from Jeppesen ForeFlight, a specialized aviation subsidiary that Boeing sold to private equity firm Thoma Bravo for $10.55 billion.
A spokesperson for Jeppesen ForeFlight maintained that internal investigations showed no adverse effects on the company’s operational integrity. "Based on our investigation to date into this claim and proactive security posture, there was no impact to our operations or products," the spokesperson stated.
Rey’s alleged involvement in the Jeppesen ForeFlight extortion attempt carries a striking personal irony. Strong evidence indicates that Khader’s father is employed by Royal Jordanian Airlines, a flag carrier largely controlled by the Jordanian government that operates long-haul passenger flights on Boeing aircraft. While Rey claimed on Telegram in early 2025 that his father worked as an airline pilot—a detail that could not be independently verified—digital forensics paint a clearer picture.
An examination of the family’s shared computer, which had previously been compromised by commercial password-stealing malware, revealed that Rey’s father routinely used identical credentials across multiple administrative portals for Royal Jordanian Airlines employees.
Royal Jordanian Airlines declined to comment on the matter. Prior to publishing investigative updates, security journalists attempted to contact Khader’s father to notify him of his son’s cybercriminal activities. Neither Khader nor his father responded to inquiries. However, within hours of the outreach, Rey began systematically scrubbing his digital footprint, deleting numerous social media profiles—including the Twitter/X account used to taunt law enforcement and victim organizations.
Despite purging his social media presence, Rey left behind a cybersecurity blog hosted on GitHub. In March 2026, the blog featured a detailed investigative post that publicly doxxed two Russian men identified as the core developers and masterminds behind the Cl0p ransomware operation.
Murder-for-Hire Allegations in the Netherlands
While federal authorities interrogated Khader in Amman, Dutch media outlets unveiled shocking new allegations concerning Pepijn van der Stap. Despite his public rehabilitation narrative—where he presented himself as a reformed hacker working as an "offensive security lead" at Amsterdam-based cybersecurity firm Neo Security—investigators uncovered darker motives.
According to a September 29 report by Dutch broadcaster RTL, law enforcement suspects Van der Stap attempted to orchestrate at least two murders. Investigators believe the targets were located abroad and that Van der Stap issued direct orders to carry out the lethal attacks.
Van der Stap had previously served the majority of a four-year prison sentence for data theft and extortion schemes that prosecutors estimated generated between €1.5 million and €2.7 million. Following his release, he secured employment at Neo Security, where founder Benjamin Korper stated that an independent forensic firm was hired to audit company networks. Thus far, investigators have found no evidence that Van der Stap compromised his employer or clients, though his arrest on September 15 brought immediate scrutiny to the startup.
Before his initial 2023 conviction, Van der Stap maintained a dual life. He worked as a software engineer for Amsterdam-based security startup Hadrian and volunteered with the Dutch Institute for Vulnerability Disclosure, all while systematically breaching and extorting major global enterprises.
When questioned about his credibility prior to his second arrest, Van der Stap expressed resignation regarding public skepticism. "You can throw a bunch of nice words at someone, but you can’t convince them if they don’t want to be convinced," he remarked. "I’m doing what I can to repay victims, and that’s all I can do."
Franchising and Burning a Brand
Security researchers emphasize that the modern incarnation of ShinyHunters bears little resemblance to the original collective of French cybercriminals who initiated high-profile data thefts as early as 2019, many of whom have since been arrested or imprisoned. Instead, the ShinyHunters name has evolved into a franchise model.
Comparing the dynamic to the mythical "Dread Pirate Roberts" from The Princess Bride, cybersecurity experts note that succession within the brand occurs not through death, but through the continuous arrest of successive operators. Investigators believe the FBI is currently focusing on a network of freelance cybercriminals who feed stolen SaaS platform credentials to whoever operates the ShinyHunters banner in exchange for a percentage of any collected ransoms.
In the wake of Van der Stap’s arrest and Khader’s subsequent detention, cybercrime forums on Telegram erupted in ridicule directed at the young Jordanian hacker. Observers accused Rey of amateurishly hijacking a tarnished brand to run independent extortion schemes. "He bought the old forum PGP key and used it to make new Breachforum websites and Telegram channels larping as ShinyHunters to ransom companies," one forum participant noted.
A specialized Telegram tracking channel known as "The Battle" relentlessly doxxed and mocked Rey and his associates, characterizing the teenager as an inexperienced greenhorn trying to leverage the notoriety of a collapsing cybercrime syndicate. According to administrative posts on the channel, Rey allegedly caused over $200 million in cumulative damages while helping minor affiliate groups negotiate ransoms for a 25 to 30 percent cut.
The group’s operational motivations were further highlighted in an interview with The Register, where ShinyHunters representatives claimed their attack on the FBI was designed to counter the agency’s public advisories. An FBI flash notice released in May 2026 warned organizations against paying ransoms and detailed the syndicate’s aggressive harassment tactics, which included threatening phone calls, text messages, and occasionally "swatting" uncooperative executives.
While the hackers argued that breaching federal infrastructure served to demonstrate their technical prowess and counteract what they viewed as misinformation, industry observers noted that the public relations campaign ultimately compromised the syndicate’s leverage. With key figures detained in Jordan and the Netherlands, and darknet infrastructure steadily dismantled, the future of the ShinyHunters franchise remains severely constrained.
Leave a Reply