A teenager residing in Amman, Jordan, suspected of acting as a principal leader of the prolific data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the FBI to help unmask other members of the hacking collective.
According to investigative reporting by KrebsOnSecurity, the suspect—who operates online under the hacker handle “Rey”—was taken into custody just as the group was actively attempting to extort a business unit recently divested by global aerospace manufacturing giant Boeing. Interestingly, the employer of Rey’s father is Royal Jordanian Airlines, a carrier that operates a fleet primarily composed of Boeing commercial aircraft.
The detention broke into public view when Reuters cited three unnamed sources confirming that a suspected ShinyHunters member in Amman, identified as Saif Al-din Khader, had been detained by Jordanian law enforcement and was actively assisting the FBI. KrebsOnSecurity had previously linked the moniker "Rey" to Khader in a November 2025 profile, during which the young man openly admitted to collaborating with multiple ransomware operations.
Rey’s name surfaced again in late September during an exclusive report detailing the Dutch police arrest of 24-year-old convicted cybercriminal Pepijn van der Stap, who was suspected of assisting ShinyHunters in their data theft and extortion schemes. Intelligence indicated that immediately following Van der Stap’s arrest on the evening of September 15, Rey seized control of the ShinyHunters brand, taking to social media to publicly boast about infiltrating the FBI and attempting to extort the established ransomware syndicate Cl0p.
To complicate matters, Rey taunted both the FBI and Cl0p by posting a series of memes on his long-standing Twitter/X account. Embedded within these posts were graphic elements featuring the avatar of Van der Stap’s former online alias, "Umbreon," in an apparent attempt to frame the Dutch national for the high-profile hacks.
The campaign orchestrated by ShinyHunters relied on exploiting a critical zero-day vulnerability, designated as CVE-2026-35273, within PeopleSoft. This software-as-a-service platform, developed by Oracle, is widely utilized by major corporations and government entities for human resources management, recruitment, payroll, and benefits administration. Oracle moved quickly to patch the vulnerability after ShinyHunters began mass-exploiting it in June, while Mandiant issued emergency web application firewall (WAF) rules for organizations unable to apply the security update immediately.
In communications with BleepingComputer in June, ShinyHunters revealed that their initial intent behind exploiting the PeopleSoft flaw was to breach the FBI’s own internal PeopleSoft database, though those initial attempts reportedly encountered hurdles. In the weeks leading up to the arrests, however, the group bypassed Mandiant’s recommended defenses by deploying a well-known URL-encoding trick.
A joint threat intelligence report released in late September by Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters had mass-exploited the PeopleSoft vulnerability to siphon data from dozens of systems across diverse sectors, including higher education, technology, healthcare, agriculture, transportation, and government agencies. Subsequent media reports revealed that the FBI had to remove an Accenture contractor following a damaging data breach of the bureau’s recruitment website. That intrusion exposed sensitive personnel records belonging to more than 5,000 FBI employees, detailing specific units, specializations, and medical records.
"Rey" Means King, As in Royal
Sources familiar with the ongoing international investigation into ShinyHunters confirmed that a digital aviation and navigation unit divested by Boeing was among the primary targets being extorted by the group at the time of Rey’s apprehension. The inclusion of this target injected a renewed sense of urgency into the FBI’s investigation, given that the compromised information from the former Boeing unit carried potential operational safety and security implications.
In statements provided to security researchers, Boeing acknowledged the extortion attempts tied to data stolen from Jeppesen ForeFlight, a subsidiary that Boeing sold to private equity firm Thoma Bravo for $10.55 billion. Representatives for Jeppesen ForeFlight maintained that an internal investigation revealed no adverse impact on their operational capabilities or products.
Rey’s connection to the aerospace sector drew heightened scrutiny due to evidence indicating his father worked for Royal Jordanian Airlines, a government-influenced carrier heavily reliant on Boeing aircraft. While Rey had claimed on Telegram earlier in the year that his father was an airline pilot—a detail that could not be independently verified—previous investigative profiles revealed that a shared family computer had been compromised by password-stealing malware. Logs retrieved from that malware showed Rey’s father utilizing identical credentials across multiple administrative portals for Royal Jordanian Airlines employees.
Following media inquiries and outreach to the Khader family, Rey began scrubbing his digital footprint, deleting numerous social media profiles including the Twitter/X account used to mock law enforcement and rival cybercriminal groups. Despite purging his social channels, Rey’s personal cybersecurity blog hosted on GitHub remained active, featuring a lengthy investigative post published earlier in the year that attempted to dox two Russian men alleged to be the core developers behind the Cl0p ransomware operation.
Murder for Hire Allegations
Meanwhile, criminal proceedings in the Netherlands introduced explosive new allegations against Pepijn van der Stap, whose narrative of personal rehabilitation and transition into legitimate security work had previously captured media attention. Dutch daily newspaper RTL reported that investigators suspect Van der Stap attempted to orchestrate at least two contract murders to be carried out abroad.
Van der Stap had previously served the majority of a four-year prison sentence for extensive data theft and extortion activities that prosecutors estimated yielded between 1.5 million and 2.7 million euros. Following his release, he secured employment as an "offensive security lead" at Dutch cybersecurity firm Neo Security, where he claimed his responsibilities involved authorized penetration testing.
Following Van der Stap’s dramatic midnight arrest—which reportedly involved Dutch tactical units deploying flash-bang grenades—Neo Security’s management engaged an independent firm to audit internal networks. The review found no evidence that Van der Stap had compromised his employer or clients. Before his initial 2023 conviction, Van der Stap had worked as a software engineer for an Amsterdam-based startup while volunteering with the Dutch Institute for Vulnerability Disclosure, operating illicitly behind a facade of legitimate industry involvement.
Franchising and Burning a Brand
Security researchers note that the individuals operating under the modern ShinyHunters banner are distinct from the group’s original core members, many of whom are French nationals previously apprehended by European law enforcement. Over time, the ShinyHunters moniker has evolved into a criminal franchise model. Much like the literary concept of the Dread Pirate Roberts, the brand persists through successive waves of arrests, with decentralized freelancers feeding stolen SaaS credentials to the collective in exchange for a percentage of any collected ransoms.
In the wake of Van der Stap’s arrest and the subsequent takedown of the group’s darknet infrastructure, cybersecurity chat channels on Telegram erupted with criticism directed at Rey. Commentators accused the teenager of hijacking an exhausted brand name to launch amateurish extortion schemes, damaging what little reputation the original collective maintained. Observers noted that Rey had acquired legacy cryptographic keys to launch fake forums and Telegram channels, attempting to monetize stolen data caches before his operations collapsed.
A specialized Telegram tracking channel known as "The Battle" dedicated weeks to doxing and mocking Rey and his associates, characterizing the teenager as an inexperienced greenhorn attempting to leverage a notorious brand. According to administrative posts on these channels, Rey was accused of generating millions in damages while acting as a broker for small affiliate groups, negotiating ransoms in exchange for a substantial cut of the proceeds.
The group’s public friction with law enforcement culminated earlier in the year when the FBI issued a formal flash notice warning organizations against paying ransoms to ShinyHunters. The advisory highlighted the group’s aggressive harassment tactics, which included threatening phone calls, text messages, and swatting incidents directed at corporate executives and their families.
In interviews with cybersecurity journalists, representatives for ShinyHunters argued that their high-profile digital intrusions were executed largely as public relations maneuvers designed to counter law enforcement warnings and reassert their technical capabilities in the face of coordinated global investigations.
Leave a Reply