A teenager from Amman, Jordan, suspected of leading the prolific data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with federal investigators. According to findings by KrebsOnSecurity, the suspect—who operates under the hacker handle “Rey”—was apprehended just as the cybercrime collective was actively extorting a business unit recently divested by global aerospace titan Boeing.
The coincidence of the target carries an intriguing personal connection: Boeing manufactures the fleet of aircraft utilized by Royal Jordanian Airlines, the employer of Rey’s father.
Initial reports surfaced when Reuters cited three unnamed sources confirming that a suspected ShinyHunters member in Amman, identified as Saif Al-din Khader, had been taken into custody by Jordanian law enforcement and was actively assisting the Federal Bureau of Investigation (FBI). KrebsOnSecurity had previously unmasked Rey as Khader in a November 2025 profile, during which the young man openly admitted to maintaining operational ties with multiple ransomware groups.
The tightening net around Khader follows a turbulent month of international law enforcement actions. Rey was thrust back into the spotlight following an exclusive report detailing the September 15 arrest of 24-year-old Dutch cybercriminal Pepijn van der Stap by Dutch police. Van der Stap, a convicted felon, is suspected of facilitating data thefts and high-stakes extortions on behalf of ShinyHunters.
Immediately following the Dutchman’s dramatic nighttime arrest—which reportedly involved the use of flash-bang grenades by specialized police units in Amsterdam—Rey assumed unilateral control over the ShinyHunters brand. From his digital outpost, he brazenly boasted about breaching highly sensitive networks, including systems belonging to the FBI, and launched an extortion campaign against the rival Cl0p ransomware syndicate.
Using his long-standing account on Twitter/X, Rey taunted both federal law enforcement and the Cl0p operators with a series of memes. In an apparent attempt to deflect suspicion and frame his arrested peer, Rey purposefully incorporated images of the avatar once used by Van der Stap under his former hacker alias, “Umbreon.”
Investigators revealed that ShinyHunters managed to breach the FBI’s recruitment portal and various other corporate victims by exploiting a critical zero-day vulnerability, designated as CVE-2026-35273, residing within Oracle PeopleSoft. Oracle’s SaaS platform is widely deployed across enterprise environments globally to manage mission-critical human resources, payroll, benefits, and hiring pipelines.
Although Oracle moved swiftly to issue a security patch after the flaw began exploitation in June, and Mandiant subsequently released web application firewall (WAF) rules for organizations unable to apply immediate updates, the threat actors adapted. According to security advisories from BleepingComputer, ShinyHunters initially targeted the FBI’s PeopleSoft databases with their zero-day exploits, though those early attempts were reportedly unsuccessful. In subsequent weeks, the collective bypassed Mandiant’s defensive controls by employing a well-known URL-encoding trick.
A joint threat intelligence report released in late September by Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters had mass-exploited the PeopleSoft vulnerability. The campaign compromised dozens of systems spanning a diverse array of sectors, including higher education, technology, healthcare, agriculture, transportation, and government agencies.
Further compounding the fallout, Reuters reported that the FBI removed an Accenture contractor over failures to patch the compromised recruitment website. That breach exposed sensitive information belonging to more than 5,000 FBI personnel, detailing specific units, specializations, and even confidential medical and psychiatric records.
"Rey" Means King, As in Royal
According to sources familiar with the ongoing international investigation, the FBI’s pursuit of ShinyHunters gained explosive momentum when the group targeted a navigation and digital aviation division recently divested by Boeing. The stolen data from this specific unit posed significant operational safety and security risks, prompting immediate escalation from federal authorities.
Boeing formally acknowledged the extortion attempts in a statement, confirming that the incident centered on data stolen from Jeppesen ForeFlight. Boeing had previously sold the subsidiary to private equity firm Thoma Bravo in November 2025 for $10.55 billion.
"We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight," a Boeing spokesperson stated, adding that the company was actively reviewing the situation. Conversely, a representative for Jeppesen ForeFlight maintained that their proactive security posture insulated them from real-world harm, noting that investigations found zero impact on their day-to-day operations or products.
Rey’s alleged role in targeting the former Boeing division drew immediate scrutiny due to his family background. Evidence indicates his father is employed by Royal Jordanian Airlines, a carrier predominantly controlled by the Jordanian government that relies heavily on Boeing aircraft for its long-haul operations. While Rey claimed on Telegram in early 2025 that his father worked as an airline pilot, that specific detail could not be independently verified.
However, digital forensics from a password-stealing malware infection on the family’s shared computer showed that Rey’s father routinely utilized identical login credentials across various online portals dedicated to Royal Jordanian Airlines employees.
Royal Jordanian Airlines has not responded to requests for comment regarding the security breach of employee portals. Shortly after KrebsOnSecurity contacted Rey’s father prior to the late-September publication, Rey systematically scrubbed and deleted his social media presence, including the Twitter/X handle used to mock the FBI and Cl0p.
Despite the purge of his social platforms, Rey’s technical blog hosted on GitHub remained active. A lengthy post published in March 2026 featured a detailed doxxing investigation that outed two Russian men as the core developers and operational masterminds behind the Cl0p ransomware ecosystem.
Murder-for-Hire Allegations
While Khader sits in detention in Amman, legal proceedings in the Netherlands have introduced far darker allegations against Van der Stap. Despite widespread media coverage celebrating his purported rehabilitation from cybercriminal to defensive security professional, Dutch daily newspaper RTL reported that investigators suspect Van der Stap of attempting to orchestrate at least two murders abroad.
Following his release from prison—where he served the majority of a four-year sentence for extortions yielding between 1.5 million and 2.7 million euros—Van der Stap secured a position as an "offensive security lead" at Neo Security, an Amsterdam-based cybersecurity firm. Neo Security’s owner, Benjamin Korper, told reporters that an independent firm was immediately hired to audit the company’s systems following Van der Stap’s arrest. Investigators reportedly found no evidence that Van der Stap compromised his employer or its clients, though Dutch tactical units raided his residence in a high-profile operation.
Before his initial 2023 conviction, Van der Stap maintained a dual life: working as a software engineer at Amsterdam startup Hadrian and volunteering for the Dutch Institute for Vulnerability Disclosure (DIVD), while simultaneously infiltrating and extorting major international targets. When questioned about how he expected outsiders to trust his claims of reform, Van der Stap defended his position by pointing to his restorative efforts.
"You can throw a bunch of nice words at someone, but you can’t convince them if they don’t want to be convinced," Van der Stap remarked. "I’m doing what I can to repay victims, and that’s all I can do."
Franchising and Burning a Brand
Security analysts note that the individuals operating today under the ShinyHunters banner bear little resemblance to the group’s original French core, many of whom have already faced arrest and imprisonment. Instead, ShinyHunters has evolved into an illicit franchise model. Much like the literary concept of the Dread Pirate Roberts, the moniker is passed along or assumed by successive criminal actors, sometimes with multiple individuals claiming the mantle simultaneously.
Investigators indicate that the FBI is concentrating its efforts on a network of freelance cybercriminals who trade stolen software-as-a-service credentials in exchange for a percentage of ransoms paid by corporate victims.
In the wake of Van der Stap’s arrest, underground Telegram chat servers associated with Rey erupted with derision. Former associates mocked the teenager for capitulating under pressure from law enforcement and for overseeing the sudden offline transition of the ShinyHunters darknet portal. Commentators accused Rey of co-opting the established brand name to run amateur extortion operations and peddle stolen corporate databases for personal enrichment.
Administrators of "The Battle," a dedicated cybercrime-tracking Telegram channel that has relentlessly doxxed Rey and his associates, argued that the teenager fundamentally misunderstood the weight of the name he adopted.
"Rey made a serious mistake when he started pretending to be a member of ShinyHunters," the channel administrators wrote, noting that the original syndicate had long since been dismantled by law enforcement. Observers estimate that Rey’s affiliate network generated upwards of $200 million in cumulative damages by leveraging the group’s notoriety to negotiate ransom cuts ranging between 25 and 30 percent.
In interviews with cybersecurity publication The Register, representatives of the modern ShinyHunters faction asserted that their decision to target the FBI was a calculated public relations maneuver. The attack was allegedly designed to retaliate against an official May 2026 advisory issued by the Internet Crime Complaint Center (IC3), which warned corporations against paying ransoms to the group and detailed coercive tactics such as direct phone calls, text messages, and physical swatting incidents against uncooperative executives.
By striking federal infrastructure, the hackers sought to puncture the government’s narrative. Yet, industry experts emphasize that the very publicity campaign intended to restore the group’s illicit market value ultimately served to accelerate its undoing, culminating in international raids, cooperative interrogations in Amman, and the steady dismantling of the franchise’s remaining affiliates.
