A teenage resident of Amman, Jordan, suspected of acting as a central figure in the prolific data theft and extortion collective known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the Federal Bureau of Investigation (FBI) to help identify other members of the hacking syndicate.
According to investigative reporting by KrebsOnSecurity and initial confirmations from international news outlets, the suspect uses the online hacker handle “Rey.” Law enforcement officials detained Rey just as the ShinyHunters operation was actively engaged in an extortion campaign targeting a business unit recently divested by global aerospace giant Boeing. In a striking twist of geopolitical and corporate overlap, this targeted subsidiary manufactures the specialized navigation fleet utilized by Royal Jordanian Airlines—the very employer of the suspect’s father.
On October 3, Reuters cited three unnamed sources confirming that a suspected ShinyHunters member in Amman named Saif Al-din Khader had been taken into custody by Jordanian law enforcement and was actively assisting the FBI. KrebsOnSecurity previously identified Rey as Khader in a November profile published in 2025, during which the young man openly acknowledged his associations with multiple ransomware and extortion syndicates.
Rey’s activities captured headlines once again following a September 28 exclusive detailing the arrest of 24-year-old convicted Dutch cybercriminal Pepijn van der Stap by police in the Netherlands. Van der Stap was apprehended on suspicion of facilitating data thefts and financial extortions for ShinyHunters. Investigators noted that almost immediately following the dramatic Dutch police raid on the evening of September 15, Rey seized operational control of the ShinyHunters brand. He leveraged the notoriety of the moniker to publicly boast about infiltrating the FBI and extorting the rival ransomware group Cl0p.
Using his long-standing account on Twitter/X, Rey taunted both federal law enforcement and the Cl0p ransomware operators with custom memes. He embedded images of the avatar previously utilized by Van der Stap under his former hacker alias, “Umbreon,” in an apparent, calculated attempt to frame the Dutch citizen for the high-profile hacks.
The digital intrusions that fueled this latest wave of chaos traced back to a severe vulnerability—cataloged as CVE-2026-35273—affecting Oracle PeopleSoft. This widely implemented software-as-a-service platform is utilized by enterprise organizations globally to manage core internal operations, including human resources, payroll systems, candidate hiring, and employee benefits. Oracle moved swiftly to release a security patch after ShinyHunters began weaponizing the vulnerability as a zero-day exploit in June. Concurrently, cybersecurity firm Mandiant issued emergency web application firewall (WAF) rules to protect organizations unable to immediately deploy Oracle’s official security updates.
While initial reports indicated that the primary objective of exploiting PeopleSoft was to breach the FBI’s proprietary internal databases, those initial attempts reportedly fell short of the attackers’ expectations. However, as security analysts observed in subsequent weeks, ShinyHunters managed to pivot, adopting a well-documented URL-encoding evasion technique designed to bypass Mandiant’s recommended firewall rules.
In a comprehensive threat intelligence briefing released in late September, security experts from Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters had executed a mass-exploitation campaign targeting PeopleSoft instances across a vast array of critical industries. The compromised victims spanned higher education, technology, healthcare, agriculture, transportation, and government sectors.
Further compounding the fallout, Reuters reported that the FBI removed an Accenture contractor following a damaging data breach of the bureau’s recruitment portal. The incident exposed sensitive personal and professional details concerning more than 5,000 FBI personnel, including specialized unit assignments, security classifications, and private medical and psychiatric records.
‘Rey’ Means King, as in Royal
According to sources close to the international cybercrime investigation, a digital aviation and navigation unit divested by Boeing was right in the crosshairs of ShinyHunters’ extortion scheme when Jordanian authorities moved in to arrest Rey. The attempted extortion of the former Boeing subsidiary alarmed investigators, who noted that the stolen proprietary information introduced significant operational safety and security risks.
In a brief corporate statement, Boeing acknowledged that it was aware of extortion claims leveled by the threat actors regarding data associated with the aerospace firm and its former subsidiary, Jeppesen ForeFlight. Boeing completed the sale of Jeppesen ForeFlight to private equity firm Thoma Bravo for $10.55 billion.
A spokesperson for Jeppesen ForeFlight addressed the security claims directly, stating that internal reviews indicated no adverse impact. "Based on our investigation to date into this claim and proactive security posture, there was no impact to our operations or products," the company said.
Rey’s alleged role in targeting the former Boeing-linked entity drew intense scrutiny due to evidence connecting his family to Royal Jordanian Airlines. The airline, largely controlled by the Jordanian government, operates its long-haul commercial fleet using Boeing aircraft. While Rey claimed on Telegram channels that his father worked as an airline pilot, those assertions could not be independently verified. However, forensic analysis from a previous cybersecurity profile revealed that a shared family computer had been infected with password-stealing malware. Data extracted from that malware demonstrated that Rey’s father utilized identical credentials across multiple official portals dedicated to Royal Jordanian Airlines employees.
Despite repeated outreach from journalists, neither Rey nor his father responded to requests for comment. However, shortly after investigative inquiries were sent to the family home, Rey began systematically purging his social media footprint, scrubbing the Twitter/X accounts previously used to taunt law enforcement agencies and rival threat actors.
Despite deleting his mainstream social media profiles, Rey’s personal technical blog hosted on GitHub remained active. The archive revealed a deep fixation on the leadership behind the Cl0p ransomware group. A lengthy investigative post published on the blog in March doxxed two Russian nationals whom Rey identified as the core developers and operational masterminds behind Cl0p.
Murder for Hire Allegations
Meanwhile, criminal investigations in the Netherlands introduced shocking new dimensions to the legal proceedings surrounding Van der Stap. Despite his public rehabilitation narrative—where he frequently presented himself as a reformed hacker—Dutch daily newspaper RTL reported that investigators suspect Van der Stap of orchestrating at least two contract murders. Authorities believe these planned violent acts were intended to be executed abroad.
Van der Stap had recently completed the majority of a four-year prison sentence stemming from previous data theft and extortion convictions that prosecutors estimated netted between 1.5 million and 2.7 million euros. Following his release, he secured employment as an "offensive security lead" at Neo Security, a Dutch cybersecurity firm where he was tasked with testing client network defenses.
Neo Security’s owner, Benjamin Korper, told reporters that the firm retained an independent third-party investigator to determine whether Van der Stap had compromised internal systems or client environments. To date, auditors have found no evidence of malicious activity directed against the employer. Korper added that Dutch forensic teams arrived at his corporate offices on the night of September 15 during the tactical police raid that resulted in Van der Stap’s arrest.
Prior to his initial legal troubles, Van der Stap worked as a software engineer for an Amsterdam-based security startup while volunteering for the Dutch Institute for Vulnerability Disclosure (DIVD), even as he covertly engaged in corporate extortion schemes. When questioned about how individuals could trust his rehabilitation after years of deception, Van der Stap maintained that his technical contributions would ultimately define his legacy.
Franchising and Burning a Brand
Cybercriminals operating under the ShinyHunters banner have been linked to dozens of massive data breaches accounting for billions of compromised records, with operations stretching back to 2019. Security researchers emphasize, however, that the individuals currently orchestrating attacks under the name are distinct from the original core members, most of whom are French nationals previously arrested by European law enforcement.
Analysts describe ShinyHunters as having evolved into a decentralized franchise model. Rather than a centralized hierarchy, the modern incarnation functions similarly to a digital syndicate where freelancers and cybercriminal affiliates feed stolen SaaS credentials to transient administrators in exchange for a percentage of any successful ransom payouts.
In the wake of Van der Stap’s arrest, underground Telegram channels operated by Rey became battlegrounds for ridicule. Fellow cybercriminals mocked the teenager for capitulating under pressure from the FBI and for the abrupt offline status of the ShinyHunters darknet portal. Commentators accused Rey of purchasing historical forum credentials and resurrecting defunct infrastructure merely to larp as a high-level extortionist, thereby diluting the group’s reputation.
Administrators of an antagonistic Telegram tracking channel known as "The Battle" criticized Rey for attempting to inherit a dismantled brand. According to community estimates cited in the tracker, Rey’s network was allegedly responsible for generating substantial illicit revenues by negotiating enterprise extortions and taking a cut ranging from 25 to 30 percent.
In prior statements to technology media outlets, representatives of the modern ShinyHunters collective claimed that their decision to target the FBI was a strategic public relations maneuver designed to counteract an official advisory published by the bureau. The FBI’s May flash notice had explicitly warned organizations against yielding to ransom demands, detailing aggressive tactics deployed by the group—including harassing phone calls, text messages, and physical swatting incidents—while noting that threat actors frequently bluff about possessing sensitive or compromising media.
While the hackers argued that their high-profile targeting of federal infrastructure demonstrated technical competence and countered public warnings, security analysts noted that such brazen escalations ultimately catalyzed intense, coordinated international law enforcement responses, culminating in the dismantling of their infrastructure and the arrest of key facilitators across multiple continents.
Comments (0)