A teenager based in Amman, Jordan, suspected of leading the prolific and destructive data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the FBI. According to investigative reporting by KrebsOnSecurity, citing sources familiar with the matter, the suspect uses the hacker handle “Rey.” His apprehension occurred precisely as the syndicate was in the middle of an aggressive extortion campaign targeting a recently divested business unit of global aerospace giant Boeing. Coincidentally, the young man’s father is employed by Royal Jordanian Airlines, a carrier that operates a fleet primarily composed of Boeing aircraft.
The initial confirmation of the arrest broke on October 3, when Reuters cited three unnamed sources reporting that a suspected ShinyHunters member named Saif Al-din Khader had been detained by Jordanian law enforcement and was actively assisting the FBI. KrebsOnSecurity had previously identified "Rey" as Khader in a detailed profile published in November 2025, during which the young individual acknowledged collaborating with multiple distinct ransomware and extortion groups.
Rey re-entered the global spotlight in late September following a high-profile law enforcement sweep. Dutch police announced the arrest of 24-year-old convicted cybercriminal Pepijn van der Stap on suspicion of providing operational assistance to ShinyHunters in their data theft and extortion schemes. Intelligence indicated that almost immediately following Van der Stap’s arrest on the evening of September 15, Rey seized control of the volatile ShinyHunters brand. From that newly assumed position of authority, he publicly boasted about breaching highly sensitive systems belonging to the FBI and launching extortion attempts against the rival Cl0p ransomware operation.
To magnify the chaos, Rey taunted both federal investigators and the Cl0p syndicate by publishing mocking memes on his long-standing Twitter/X account. Ingeniously malicious, his posts incorporated the digital avatar of Van der Stap’s former hacking alias, “Umbreon,” in an explicit effort to frame the recently arrested Dutchman for the fresh wave of high-profile attacks.
The underlying infrastructure enabling these brazen breaches relied on the mass exploitation of a software vulnerability—designated as CVE-2026-35273—affecting PeopleSoft, a software-as-a-service platform developed by tech titan Oracle. Widely deployed across corporate enterprises to manage complex human resources operations, payroll, hiring, and employee benefits, PeopleSoft became a goldmine for attackers. Oracle moved quickly to patch the vulnerability after ShinyHunters began utilizing it as a zero-day exploit in June. Concurrently, cybersecurity firm Mandiant issued emergency web application firewall (WAF) rules designed to protect organizations incapable of immediately applying Oracle’s official security update.
Initial chatter on hacker forums revealed that ShinyHunters originally targeted the vulnerability in June with the specific ambition of breaching the FBI’s internal PeopleSoft database, though those initial attempts reportedly fell short. In subsequent weeks, however, the group pivoted, deploying a well-documented URL-encoding trick designed to completely bypass Mandiant’s recommended firewall mitigations.
By late September, security researchers at Mandiant and the Google Threat Intelligence Group (GTIG) confirmed via a joint report that the group had executed a mass-exploitation campaign. The attacks successfully harvested data from dozens of enterprise networks across multiple sectors, including technology, higher education, healthcare, transportation, agriculture, and government agencies.
The fallout from these intrusions proved severe. Reuters reported that the FBI was forced to remove an Accenture contractor following a damaging data breach on the bureau’s recruitment portal. The security lapse exposed sensitive background and personnel records belonging to more than 5,000 FBI employees, including detailed assignments, specializations, and even confidential medical and psychiatric histories.
‘Rey’ Means King, as in Royal
As investigations deepened, sources familiar with the probe revealed that an aviation navigation and digital mapping unit recently divested by Boeing was directly in the crosshairs of ShinyHunters’ extortionists when Rey was captured. The attempted shakedown of the former Boeing division added immense urgency to the FBI’s investigation, particularly because the stolen data allegedly posed genuine operational safety and security risks.
In a brief corporate statement, Boeing acknowledged being aware of the extortion threats directed at data originating from Jeppesen ForeFlight, a specialized subsidiary that Boeing sold to private equity firm Thoma Bravo for $10.55 billion in November 2025.
"We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight," a Boeing spokesperson noted, adding that the corporation was actively reviewing the situation alongside the Jeppesen ForeFlight team.
Representatives for Jeppesen ForeFlight maintained an optimistic outlook regarding their technical posture. In a written response to inquiries, a spokesperson confirmed that an internal review found no operational fallout. "Based on our investigation to date into this claim and proactive security posture, there was no impact to our operations or products."
Rey’s alleged role in targeting the former Boeing unit carries personal irony. Strong evidence indicates his father works for Royal Jordanian Airlines, a carrier largely controlled by the Jordanian government that relies entirely on long-haul passenger jets manufactured by Boeing. Although Rey claimed on Telegram in early 2025 that his father was an airline pilot, that specific detail could not be independently verified.
However, forensic analysis detailed in prior investigative profiles revealed that a shared family computer had previously been compromised by password-stealing malware. The harvested logs clearly demonstrated that Rey’s father utilized identical credentials to access multiple internal portals meant exclusively for Royal Jordanian Airlines employees.
Royal Jordanian Airlines declined to immediately respond to requests for comment. Prior to publishing updates on the case, security researchers reached out to Rey’s father to inform him of his son’s alleged illicit activities. Neither of the Khaders replied. Within hours of that outreach, however, Rey began systematically purging his digital footprint, deleting numerous social media profiles, including the Twitter/X account used to mock federal law enforcement and corporate victims.
Despite scrubbing his mainstream social media presence, Rey’s technical blog hosted on GitHub remained intact. The archive revealed a persistent fixation on the leadership of the Cl0p ransomware group. A lengthy post published on the blog in March doxes two Russian nationals identified by the author as the primary developers and masterminds behind Cl0p, one of the oldest operational ransomware syndicates.
Murder for Hire Allegations
Meanwhile, legal proceedings in the Netherlands brought forward startling new allegations against Pepijn van der Stap, whose narrative of personal rehabilitation had previously captivated tech journalists. Dutch daily newspaper RTL reported that investigators suspect Van der Stap attempted to orchestrate at least two contract murders to be executed abroad, allegedly issuing direct orders for the fatal attacks.
Van der Stap had recently completed the majority of a four-year prison sentence for extensive data theft and extortion operations that prosecutors estimated generated between €1.5 million and €2.7 million. Following his release, he secured employment as an "offensive security lead" at Neo Security, a Dutch cybersecurity firm where he reportedly tested client network defenses.
Neo Security owner Benjamin Korper told reporters that he immediately hired an independent forensic firm to audit his company’s networks and determine if Van der Stap had compromised internal systems or client data. Investigators reportedly found no evidence of malicious activity directed against the employer. However, the corporate audit was initiated mere hours after Dutch tactical police launched a dramatic raid—complete with flash-bang grenades—on Van der Stap’s residence on the night of September 15.
Before his initial 2023 arrest, Van der Stap maintained a dual life, working as a software engineer for Amsterdam-based cybersecurity startup Hadrian while volunteering for the Dutch Institute for Vulnerability Disclosure (DIVD), all while quietly breaching and extorting corporate targets. When questioned about how the public could trust a self-described reformed hacker who deceived colleagues and journalists for years, Van der Stap maintained that his subsequent actions defined him.
"You can throw a bunch of nice words at someone, but you can’t convince them if they don’t want to be convinced," Van der Stap stated. "I’m doing what I can to repay victims, and that’s all I can do. If someone doesn’t want to believe me, then that’s on them."
Franchising and Burning a Brand
Cybercriminals operating under the ShinyHunters banner have been linked to dozens of massive data breaches accounting for billions of stolen records, with campaigns dating back to at least 2019. Security experts emphasize, however, that the individuals controlling the moniker today bear little resemblance to the group’s original core members, most of whom are French nationals who have faced arrest and prosecution.
Instead, ShinyHunters has evolved into a decentralized criminal franchise. Security analysts compare the structure to the fictional Dread Pirate Roberts from the classic film The Princess Bride, where succession is determined by arrest rather than death, and multiple independent actors can operate under the same banner simultaneously. Investigators note that federal authorities are increasingly focused on freelance cybercriminals and affiliates who supply stolen corporate SaaS credentials in exchange for a cut of subsequent ransom payments.
In the wake of Van der Stap’s arrest, a Telegram chat server allegedly administered by Rey erupted in intense internal conflict. Community members openly ridiculed the teenage hacker after he backed down from threats directed at the FBI and Cl0p, particularly as the main ShinyHunters darknet portal abruptly went offline. Critics accused Rey of commercializing the dormant brand after its original founders were neutralized by French authorities.
"He bought the old forum PGP key and used it to make new Breachforum websites and Telegram channels larping as ShinyHunters to ransom companies and then sell the used data or resell his forum when he goes broke," one forum participant alleged.
A dedicated Telegram channel named "The Battle" has spent weeks publicly doxing and criticizing Rey and other suspected affiliates. Channel administrators characterized Rey as an inexperienced novice attempting to leverage a legendary cybercrime brand.
"Rey (Saif Al-Din Khader) made a serious mistake when he started pretending to be a member of ShinyHunters," the administrators wrote. "That group had already been dismantled, with many of its members either arrested or imprisoned, yet Rey still chose to use its name while carrying out his crimes."
In prior communications with technology publications, representatives for the modern iteration of ShinyHunters claimed their attacks against federal infrastructure were launched to counter public awareness advisories published by the FBI. In a formal flash notice released in May, the FBI warned organizations against paying ransoms to the syndicate, detailing aggressive extortion tactics that included direct text messages, phone calls, and swatting incidents directed at victims and their families.
While the hackers argued that breaching high-profile targets was designed to showcase technical competence and counter negative industry reports, they conceded that federal warnings severely hampered their ability to convince corporate victims to pay. Ultimately, the criminal enterprise functioned less like a cohesive ideological collective and more like a volatile commercial branding exercise, culminating in a swift international crackdown that has dismantled another generation of cyber extortionists.
