A teenager from Amman, Jordan, suspected of operating as a key leader of the prolific data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the FBI to help unmask remaining members of the hacking collective.
According to intelligence gathered by KrebsOnSecurity, the suspect—who operated under the hacker handle “Rey”—was apprehended just as the group was actively attempting to extort a business unit recently divested by the global aerospace giant Boeing. In a striking coincidence that highlights the complex web of modern cybercrime, this targeted Boeing unit manufactures aviation fleets utilized by Royal Jordanian Airlines, the employer of Rey’s own father.
The arrest was first brought to light when Reuters cited three unnamed sources confirming that a suspected ShinyHunters member named Saif Al-din Khader had been detained in Amman and was assisting federal investigators. KrebsOnSecurity previously identified Rey as Khader in a November 2025 investigative profile, in which the young man openly acknowledged working alongside multiple ransomware factions.
Rey’s criminal footprint drew renewed scrutiny following a September 28 exclusive detailing the Dutch police arrest of 24-year-old convicted cybercriminal Pepijn van der Stap. Authorities suspect Van der Stap aided and abetted ShinyHunters in a series of damaging data thefts and extortion plots. Reports indicate that immediately following the Dutchman’s dramatic arrest on the evening of September 15, Rey seized control of the volatile ShinyHunters brand. From there, he launched public boasts claiming responsibility for breaching the FBI and extorting the notorious Cl0p ransomware organization.
In an effort to throw investigators off his trail, Rey taunted both federal law enforcement and Cl0p using memes posted to his long-standing account on Twitter/X. Simultaneously, he embedded the distinct avatar of "Umbreon"—the former hacking alias used by Van der Stap—into his posts in a calculated, transparent attempt to frame the Dutchman for the attacks.
The operational foundation behind these breaches traced back to the exploitation of a critical vulnerability, tracked as CVE-2026-35273, residing within PeopleSoft. PeopleSoft is a widely adopted software-as-a-service platform owned by Oracle that companies across industries use to manage payroll, benefits, human resources, and hiring. Oracle acted quickly to issue a patch after ShinyHunters began weaponizing the zero-day vulnerability in June. Simultaneously, cybersecurity firm Mandiant issued emergency web application firewall (WAF) rules for organizations unable to immediately apply Oracle’s security patch.
In interviews with tech publication BleepingComputer in June, ShinyHunters members admitted that their initial objective was to infiltrate the FBI’s proprietary PeopleSoft database, though those early attempts reportedly failed. In subsequent weeks, however, the group bypassed Mandiant’s recommended defenses by deploying a well-known URL-encoding evasion trick.
By late September, joint reports released by Mandiant and the Google Threat Intelligence Group confirmed that ShinyHunters had carried out a mass-exploitation campaign. The attacks targeted dozens of corporate and institutional networks spanning higher education, technology, healthcare, agriculture, transportation, and government sectors. Further compounding the fallout, Reuters reported that the FBI removed an Accenture contractor after the vendor failed to patch the vulnerable FBI recruitment portal. The breach exposed sensitive records belonging to more than 5,000 FBI personnel, including their specialized units, duty assignments, and confidential medical and psychiatric histories.
“Rey” Means King, as in Royal
As investigators dug deeper into the syndicate’s operations, sources familiar with the federal probe revealed that a navigation and digital aviation division recently divested by Boeing was in the crosshairs of an active extortion campaign when Rey was captured. This specific extortion attempt injected intense urgency into the FBI’s investigation, given that the stolen data allegedly involved proprietary information capable of introducing operational safety and security risks to aviation systems.
Boeing formally acknowledged the extortion threats in a statement, confirming that the incident centered on data stolen from Jeppesen ForeFlight. Boeing had previously sold the subsidiary to private equity firm Thoma Bravo in November 2025 for $10.55 billion.
"We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight," a Boeing spokesperson stated, adding that the company was actively reviewing the situation alongside the Jeppesen ForeFlight team. Jeppesen ForeFlight maintained that its defenses held firm, issuing a statement affirming that its internal investigation revealed zero operational impact or product compromise.
Rey’s alleged involvement in the Jeppesen ForeFlight extortion plot carries heavy ironic weight due to his familial ties. Strong digital evidence indicates his father is employed by Royal Jordanian Airlines, a carrier majority-controlled by the Jordanian government that operates its long-haul fleet on Boeing aircraft. While Rey claimed on Telegram in early 2025 that his father worked as an airline pilot—a claim that could not be independently verified—password-stealing malware recovered from a shared family computer revealed a different story. Forensic artifacts showed Rey’s father repeatedly using identical login credentials across various official online portals for Royal Jordanian Airlines employees.
Despite outreach attempts by journalists, neither Rey nor his father responded to requests for comment. Shortly after an inquiry was sent to the senior Khader regarding his son’s cyber activities, Rey abruptly began purging his digital footprint, deleting numerous social media profiles including the Twitter/X account used to mock law enforcement and corporate victims.
Even so, Rey’s technical blog hosted on GitHub managed to survive the purge. The site revealed a deep, personal fixation on the leadership of the Cl0p ransomware operation. In March 2026, Rey published a detailed investigative post attempting to expose two Russian men as the core developers and masterminds behind the Cl0p syndicate.
Murder for Hire Allegations
While the investigation into Rey unfolded in Jordan, shocking developments emerged in the Netherlands concerning the associates of Van der Stap. Despite widespread media coverage celebrating Van der Stap’s alleged rehabilitation following a four-year prison sentence for cybercrimes that netted between 1.5 million and 2.7 million euros, Dutch daily RTL published explosive reports on September 29. According to investigators, Van der Stap is now suspected of attempting to orchestrate at least two contract murders to be carried out abroad.
Before his initial arrest in 2023, Van der Stap worked as a software engineer for Amsterdam-based cybersecurity startup Hadrian while volunteering for the Dutch Institute for Vulnerability Disclosure—all while secretly hacking and extorting major organizations. Following his release, he secured a position as an "offensive security lead" at Neo Security, where he allegedly tested client networks for vulnerabilities.
Neo Security owner Benjamin Korper told Reuters that an independent firm was hired to audit Neo Security’s infrastructure to determine if Van der Stap had compromised his employer or clients. Investigators reportedly found no evidence of internal wrongdoing, though Dutch tactical police units had already raided Van der Stap’s residence on the night of September 15, reportedly utilizing flash-bang grenades during the operation.
When questioned prior to his arrest about why anyone should trust a self-proclaimed reformed hacker with a history of deception, Van der Stap insisted his remedial work spoke for itself. "You can throw a bunch of nice words at someone, but you can’t convince them if they don’t want to be convinced," he said. "I’m doing what I can to repay victims, and that’s all I can do."
Franchising and Burning a Brand
Cybercriminals operating under the ShinyHunters banner have been linked to dozens of massive data breaches compromising billions of records since 2019. However, security researchers emphasize that the individuals controlling the moniker today bear little relation to the group’s original French core members, most of whom have previously faced arrest and imprisonment.
Instead, ShinyHunters has morphed into a decentralized franchise model. Experts compare it to the fictional "Dread Pirate Roberts" persona from The Princess Bride, where succession is determined not by death, but by arrests, and multiple figures can operate under the title simultaneously. Federal investigators are now zeroing in on a loose network of freelance cybercriminals who feed stolen corporate credentials into the ecosystem in exchange for a percentage of any extracted ransoms.
In the wake of Van der Stap’s arrest, a Telegram chat server reportedly managed by Rey erupted in ridicule as the teenager publicly backed down from his threats against the FBI and Cl0p. Shortly thereafter, the primary ShinyHunters darknet portal abruptly went offline. Critics within the cybercrime underground accused Rey of commercializing a depleted brand name.
"He bought the old forum PGP key and used it to make new Breachforum websites and Telegram channels larping as ShinyHunters to ransom companies and then sell the used data," one community member alleged.
A specialized Telegram channel dubbed "The Battle" has spent weeks doxing and criticizing Rey and his associates, characterizing the teenager as an inexperienced greenhorn trying to exploit a notorious brand. According to administrators of The Battle, Rey allegedly caused more than $200 million in damages while coordinating with minor affiliate groups to negotiate corporate ransoms in exchange for a 25 to 30 percent cut.
In a defiant interview with The Register, surviving members of the ShinyHunters network claimed their decision to hack the FBI was a direct response to a May 2026 public advisory issued by the agency warning victims against paying ransoms. The hackers argued that the attack was a calculated public relations maneuver intended to reassert their technical prowess and counter the government’s narrative.
Despite their bravado, the hackers tacitly admitted that federal warnings and coordinated law enforcement pressure severely damaged their ability to coerce victims into paying, signaling another major blow to one of the cyber underworld’s most resilient extortion brands.
Leave a Reply