A teenager from Amman, Jordan, suspected of leading the prolific data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the FBI to identify other members of the sprawling hacking collective.
According to investigative reporting by KrebsOnSecurity, the suspect—who operates online under the hacker handle "Rey"—was apprehended just as the cybercrime cell was in the middle of extorting a business unit recently divested by global aerospace giant Boeing. In a striking twist of geographic irony, the suspect’s father is employed by Royal Jordanian Airlines, an enterprise that relies heavily on a fleet of commercial passenger airplanes manufactured by Boeing.
The detention comes on the heels of mounting international pressure on cybercrime syndicates that utilize franchise-style ransomware and data extortion models. On October 3, Reuters cited three unnamed sources confirming that a suspected ShinyHunters member in Amman named Saif Al-din Khader had been taken into custody by Jordanian law enforcement and was actively assisting the FBI. KrebsOnSecurity previously identified Rey as Khader in a November profile published in 2025, during which the young man admitted to collaborating with multiple ransomware operations.
Rey’s name surfaced once more in late September following an exclusive report detailing the arrest of 24-year-old Dutch cybercriminal Pepijn van der Stap by Netherlands police. Van der Stap, a convicted felon, was suspected of aiding and abetting data thefts and extortions orchestrated by ShinyHunters.
Investigators noted that immediately after the Dutchman’s dramatic arrest on the evening of September 15, Rey seized control of the ShinyHunters brand online. He publicly boasted about stealing highly sensitive data from the FBI and running extortion schemes targeting the infamous ransomware group Cl0p.
Using his longtime account on Twitter/X, Rey taunted both federal law enforcement and the Cl0p syndicate with a series of memes. Simultaneously, he embedded images of the avatar once used by Van der Stap under his former hacker alias, "Umbreon," in an apparent bid to frame the Dutch national for the high-profile hacks.
The breaches executed by the group leveraged a critical software vulnerability cataloged as CVE-2026-35273 within PeopleSoft, a software-as-a-service platform developed by Oracle. Widely implemented by enterprise organizations globally to manage human resources, payroll, benefits, and recruitment pipelines, Oracle rushed to patch the vulnerability after discovering that ShinyHunters began exploiting it as a zero-day flaw in June. Concurrently, cybersecurity firm Mandiant issued web application firewall (WAF) rules to assist organizations unable to immediately deploy the security update.
Initial reports from BleepingComputer indicated that ShinyHunters originally targeted PeopleSoft to breach the FBI’s proprietary internal databases, though those specific intrusion attempts were reportedly unsuccessful. In subsequent weeks, however, the hackers bypassed Mandiant’s defensive measures by utilizing a well-known URL-encoding trick to circumvent the recommended WAF configurations.
In a comprehensive threat intelligence briefing released in late September, security analysts from Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters had mass-exploited the PeopleSoft vulnerability. The campaign successfully extracted proprietary data from dozens of networks spanning multiple critical sectors, including higher education, technology, healthcare, agriculture, transportation, and government agencies.
Further compounding the fallout, Reuters reported that the FBI removed an Accenture contractor over failures to patch the recruitment portal that was successfully breached by ShinyHunters. That specific compromise exposed sensitive records concerning more than 5,000 personnel, detailing individual specializations, unit assignments, and confidential medical and psychiatric evaluations.
‘Rey’ Means King, as in Royal
According to sources familiar with the ongoing international investigation into the syndicate, a navigation and digital aviation unit divested by Boeing was among the active victims being targeted for extortion when Jordanian authorities closed in on Rey.
Investigators confirmed that the FBI’s pursuit of ShinyHunters gained considerable urgency following the attempted extortion of the former Boeing subsidiary. The compromised data reportedly contained proprietary technical information capable of creating operational safety and security risks.
In a brief official statement, Boeing acknowledged that it was aware of extortion attempts launched by the threat actors involving data linked to its former subsidiary, Jeppesen ForeFlight. Boeing previously sold the unit to private equity firm Thoma Bravo for $10.55 billion.
"We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight," a Boeing spokesperson stated. "We are actively reviewing the matter with the Jeppesen ForeFlight team."
Representatives for Jeppesen ForeFlight similarly addressed the claims, noting that internal audits revealed no disruption to business operations. "Based on our investigation to date into this claim and proactive security posture, there was no impact to our operations or products," a company spokesperson said in a written statement.
Rey’s alleged ties to the aviation sector have drawn intense scrutiny from researchers. Evidence indicates his father works for Royal Jordanian Airlines, a carrier predominantly controlled by the Jordanian government that operates long-haul flights on Boeing aircraft. While Rey claimed on Telegram that his father worked as an airline pilot, those assertions could not be independently verified.
However, investigative profiles previously revealed that a shared family computer was compromised by credential-stealing malware. The harvested data clearly demonstrated that Rey’s father utilized identical authentication credentials across multiple online administrative portals belonging to Royal Jordanian Airlines.
Royal Jordanian Airlines has not responded to requests for comment regarding the security incident. Ahead of previous publication deadlines, security journalists reached out to Rey’s father to notify him of his son’s digital activities, receiving no direct response from either family member. Within hours of that outreach, however, Rey began purging his online presence, systematically deleting his social media accounts—including the Twitter/X handle utilized to mock the FBI and the Cl0p ransomware gang.
Despite scrubbing his social profiles, Rey left behind a cybersecurity blog hosted on GitHub that revealed a persistent obsession with the leadership of the Cl0p ransomware operation. A lengthy post published earlier in the year successfully doxxed two Russian nationals identified by the author as the core developers and masterminds behind Cl0p.
Murder for Hire Allegations
Meanwhile, legal proceedings and investigative journalism in the Netherlands brought forth shocking allegations against Van der Stap, whose narrative of personal rehabilitation and transition to legitimate cybersecurity work had previously garnered widespread attention. Dutch daily publication RTL reported that investigators suspect Van der Stap attempted to orchestrate at least two murders outside the country, allegedly issuing direct orders for the attacks.
Van der Stap had previously served the majority of a four-year prison sentence for large-scale data theft and extortion activities that prosecutors estimated generated between €1.5 million and €2.7 million. Prior to his September arrest, he maintained employment as an offensive security lead at Dutch cybersecurity firm Neo Security, telling journalists his primary responsibility involved penetration testing and network auditing for corporate clients.
Neo Security owner Benjamin Korper confirmed that the firm retained an external auditor to investigate whether Van der Stap had compromised internal systems or client networks, though initial reviews yielded no evidence of malicious activity directed against the employer. Korper also noted that Dutch forensic teams searched his office on the night Van der Stap was apprehended during a raid utilizing flash-bang grenades.
Before his initial 2023 arrest, Van der Stap worked as a software engineer for Amsterdam-based cybersecurity startup Hadrian and volunteered with the Dutch Institute for Vulnerability Disclosure (DIVD), all while covertly penetrating and extorting prominent international organizations.
When questioned about how the public or victims could trust a self-described reformed cybercriminal, Van der Stap maintained that his actions toward restitution would ultimately define his path forward. "You can throw a bunch of nice words at someone, but you can’t convince them if they don’t want to be convinced," he said. "I’m doing what I can to repay victims, and that’s all I can do."
Franchising and Burning a Brand
Cybercriminals operating under the ShinyHunters banner have claimed responsibility for dozens of high-profile data breaches resulting in the theft of billions of records, with operations tracing back to at least 2019. Security experts emphasize, however, that the individuals controlling the moniker today bear little relation to the original core members—predominantly French nationals who have faced multiple arrests and convictions for cybercrime.
Instead, ShinyHunters has evolved into a franchise model comparable to the fictional "Dread Pirate Roberts" persona, where succession is dictated by law enforcement arrests rather than death, and multiple operators may claim the mantle simultaneously. Investigators suggest the FBI is currently concentrating its efforts on a network of freelance affiliates who feed stolen SaaS platform credentials to the group in exchange for a percentage of subsequent ransom payments.
In the wake of Van der Stap’s arrest, chat channels on Telegram previously administered by Rey erupted in internal strife. Community members criticized the teenager for folding under pressure after issuing empty threats against federal authorities and observing the sudden disappearance of the ShinyHunters darknet portal.
Commentators in cybercrime forums accused Rey of purchasing historical PGP keys and resurrecting defunct forum infrastructure to impersonate ShinyHunters for personal financial gain, ultimately damaging the group’s standing among underground peers.
Administrators of a specialized Telegram tracking channel known as "The Battle" echoed these sentiments, noting that Rey made a critical operational miscalculation by attempting to leverage a dismantled brand. According to community estimates cited on the channel, Rey allegedly generated substantial financial returns by acting as an intermediary for multiple splinter cells, negotiating ransom deals in exchange for a 25 to 30 percent commission.
In previous statements to technology publications, representatives for the hacking collective claimed their decision to target the FBI was an intentional maneuver designed to counter public threat notices issued by the agency. A May advisory warned organizations against paying ransoms to the group and detailed tactics including threatening phone calls, text messages, and physical swatting incidents directed at victims and their families.
While the hackers argued that breaching federal infrastructure served as a public relations demonstration of technical competence, security researchers note that the aggressive posture ultimately catalyzed intense, coordinated international law enforcement operations that dismantled the group’s leadership network.
