A teenager from Amman, Jordan, suspected of operating as a key leader of the prolific and aggressive data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the Federal Bureau of Investigation (FBI) to help identify other members of the global hacking collective.
According to reports from KrebsOnSecurity, the suspect—who operates online under the hacker handle "Rey"—was apprehended precisely as the ShinyHunters network was actively attempting to extort a recently divested business unit of global aerospace giant Boeing. Intriguingly, the suspect’s father is employed by Royal Jordanian Airlines, a carrier whose long-haul fleet relies heavily on passenger aircraft manufactured by Boeing, drawing an unusual parallel between the young hacker’s digital activities and his family’s aviation ties.
International news agency Reuters first cited three unnamed sources confirming that a suspected ShinyHunters member in Amman, identified as Saif Al-din Khader, was taken into custody by Jordanian law enforcement and is assisting federal investigators. KrebsOnSecurity had previously profiled Khader in November 2025 under his "Rey" handle, noting at the time that the young man openly admitted to collaborating with multiple ransomware operations.
The detention follows a dramatic escalation in international law enforcement pressure against the cybercrime ring. Rey was prominently featured in a late September 2025 investigative report detailing the arrest of 24-year-old Dutch convicted cybercriminal Pepijn van der Stap by Dutch police on suspicion of aiding ShinyHunters’ data thefts and extortion schemes. Immediately following Van der Stap’s arrest on the evening of September 15, Rey seized operational control over the ShinyHunters brand online, publicly boasting about compromising sensitive FBI data and extorting the notorious Cl0p ransomware group.
In a display of digital bravado, Rey taunted both the FBI and Cl0p using memes posted to his established social media account on Twitter/X. Within these posts, he deliberately embedded images of the avatar previously utilized by Van der Stap under his former hacker alias, "Umbreon," in what investigators believe was a calculated effort to frame the Dutch national for the fresh wave of attacks.
Security researchers note that ShinyHunters gained unauthorized access to the FBI’s recruitment portal and other corporate targets by exploiting a critical zero-day vulnerability, cataloged as CVE-2026-35273, affecting PeopleSoft. This software-as-a-service platform, developed by tech titan Oracle, is widely utilized by major global enterprises to manage human resources, recruitment, payroll, and employee benefits. Oracle moved swiftly to patch the vulnerability after ShinyHunters began mass-exploiting it in June, while Mandiant issued emergency web application firewall (WAF) rules for organizations unable to apply the security update immediately.
Although ShinyHunters initially claimed in June that their primary objective was breaching the FBI’s own PeopleSoft database—an attempt they admitted was unsuccessful at the time—the group later bypassed Mandiant’s defensive measures using a well-known URL-encoding trick. A joint threat intelligence report released in late September by Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that the syndicate successfully mass-exploited the PeopleSoft flaw to exfiltrate proprietary data from dozens of organizations spanning higher education, technology, healthcare, agriculture, transportation, and government sectors.
Further compounding the fallout, Reuters reported that the FBI removed an Accenture contractor over their failure to patch the compromised FBI recruitment website. The resulting breach exposed sensitive personnel records belonging to more than 5,000 FBI employees, including specific unit assignments, specializations, and confidential medical and psychiatric files.
"Rey" Means King, as in Royal
According to sources close to the ongoing ShinyHunters investigation, the FBI’s pursuit of the group gained intense urgency when the hackers targeted a digital aviation and navigation unit recently divested by Boeing. Investigators noted that the nature of the data stolen during this attempted extortion posed significant operational safety and security risks.
In a statement provided to security researchers, Boeing acknowledged the extortion attempt, confirming that the targeted information originated from Jeppesen ForeFlight, a subsidiary that Boeing sold in November 2025 to private equity firm Thoma Bravo for $10.55 billion. A Boeing spokesperson stated that the company is actively reviewing the situation alongside the Jeppesen ForeFlight team. Meanwhile, a spokesperson for Jeppesen ForeFlight maintained that an internal investigation revealed no operational or product impact resulting from the claims.
Rey’s suspected involvement in the Jeppesen ForeFlight extortion plot carries a striking personal context. Evidence uncovered during previous digital forensic examinations indicated that a family computer shared in Rey’s household was compromised by password-stealing malware. Logs retrieved from the malware showed Rey’s father utilizing identical credentials to access multiple online portals for Royal Jordanian Airlines employees.
Although Royal Jordanian Airlines has not responded to requests for comment, inquiries sent to Rey’s father regarding his son’s digital activities prompted an immediate digital blackout. Hours after journalists contacted the family, Rey began systematically scrubbing and deleting his various social media footprints, including the Twitter/X handle used to taunt federal investigators and ransomware operators.
Despite purging his mainstream social channels, Rey’s personal cybersecurity blog hosted on GitHub remained active. The blog featured an extensive investigative post published in March 2026 that doxed two Russian nationals allegedly serving as the core developers and masterminds behind the Cl0p ransomware operation.
Murder-for-Hire Allegations Surface in the Netherlands
Meanwhile, legal proceedings in the Netherlands have introduced explosive new allegations against Pepijn van der Stap, whose narrative of personal rehabilitation had previously garnered sympathetic media coverage. According to Dutch daily newspaper RTL, investigators suspect Van der Stap attempted to orchestrate at least two murders abroad, allegedly issuing direct orders for the attacks.
Van der Stap had recently completed the majority of a four-year prison sentence for prior data theft and extortion activities that prosecutors estimated yielded between 1.5 million and 2.7 million euros. Following his release, he secured employment as an "offensive security lead" at Amsterdam-based cybersecurity firm Neo Security, where he claimed his responsibilities included auditing client network defenses.
Neo Security owner Benjamin Korper told reporters that the firm retained an external auditor to determine whether Van der Stap had compromised internal systems or client networks, though no unauthorized activity has been uncovered thus far. Korper confirmed that Dutch forensic officers visited his office during the high-profile police raid that resulted in Van der Stap’s rearrest, which reportedly involved the deployment of flash-bang grenades.
Prior to his initial 2023 conviction, Van der Stap worked as a software engineer at Amsterdam cybersecurity startup Hadrian while volunteering for the Dutch Institute for Vulnerability Disclosure (DIVD), even as he covertly hacked and extorted major international organizations. When previously questioned about how colleagues and victims could trust his claims of reform, Van der Stap maintained that his technical work needed to speak for itself.
Franchising and Burning a Brand
While cybercriminals operating under the ShinyHunters banner have been linked to dozens of major data breaches stretching back to 2019, security experts emphasize that the current actors using the moniker are distinct from the group’s original French core members, most of whom have previously faced arrest and imprisonment.
Security analysts describe modern cybercrime groups like ShinyHunters as decentralized franchises. Much like the mythical "Dread Pirate Roberts" archetype, succession within the cyber underworld frequently occurs through law enforcement arrests rather than retirement, allowing multiple individuals to adopt the brand simultaneously. Investigators indicate the FBI is primarily focusing on a network of freelance affiliates who feed stolen software-as-a-service credentials to the collective in exchange for a percentage of any collected ransoms.
In the wake of Van der Stap’s arrest, chat servers on Telegram allegedly managed by Rey became hotbeds of criticism. Participants ridiculed the teenage hacker after he publicly backed down from threats directed at the FBI and Cl0p, particularly as the group’s darknet leak sites abruptly went offline following federal pressure. Several commentators accused Rey of amateurishly co-opting the established ShinyHunters brand for financial gain, using old Pretty Good Privacy (PGP) keys and forum databases to launch imitation extortion schemes.
Administrators of an independent Telegram monitoring channel known as "The Battle," which has spent weeks doxing and tracking alleged ShinyHunters affiliates, heavily criticized Rey’s methods. The administrators asserted that Rey caused millions of dollars in damages by establishing proxy groups that leveraged the ShinyHunters name to negotiate extortion payments, taking a cut of up to thirty percent on deals brokered over the previous several months.
In a defiant interview with technology publication The Register, representatives for ShinyHunters claimed their digital intrusion into the FBI was executed to challenge public safety advisories issued by the agency. A flash notice published by the FBI in May 2026 warned organizations against paying ransoms to the group and detailed aggressive harassment tactics employed by the syndicate, including threatening phone calls, text messages, swatting incidents, and false claims regarding sensitive or compromising victim media.
While the hackers asserted that their breach of federal infrastructure was designed to demonstrate their technical capabilities and dispute official warnings, they conceded that the FBI’s public awareness campaign severely hindered their ability to convince corporate victims to capitulate to extortion demands, ultimately transforming the conflict into a high-stakes public relations battle.
Leave a Reply