A teenager from Amman, Jordan, suspected of leading the prolific data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the FBI to identify other members of the hacking collective.
According to information obtained by KrebsOnSecurity, the suspect—who operates under the hacker handle “Rey”—was taken into custody just as ShinyHunters was in the middle of executing an aggressive extortion campaign against a business unit recently divested by global aerospace titan Boeing. Intriguingly, the company manufactures the aircraft fleet used by Royal Jordanian Airlines, the employer of Rey’s father.
The international investigation took a significant step forward when Reuters cited three unnamed sources confirming that a suspected ShinyHunters member in Amman, identified as Saif Al-din Khader, was detained by Jordanian law enforcement and is actively cooperating with federal U.S. investigators. KrebsOnSecurity previously unmasked Rey as Khader in a detailed November 2025 investigative profile, during which the young man admitted to collaborating with multiple ransomware operations.
Rey’s criminal footprint was cast into sharper relief following a September 28 exclusive detailing the arrest of 24-year-old Dutch cybercriminal and convicted extortionist Pepijn van der Stap by Netherlands police. Authorities suspect Van der Stap aided ShinyHunters in a string of high-profile data thefts. Immediately following the Dutchman’s dramatic arrest on the evening of September 15, Rey seized operational control of the ShinyHunters brand. He publicly boasted about breaching the FBI and extorting the rival Cl0p ransomware syndicate, launching a sophisticated disinformation campaign designed to pin the intrusions on Van der Stap.
To achieve this, Rey taunted both federal law enforcement and the Cl0p operators with inflammatory memes posted to his long-standing Twitter/X account. Embedded within these posts were explicit references to the avatar once used by Van der Stap under his former hacker alias, “Umbreon,” signaling a deliberate attempt to frame the Dutchman for the fresh wave of cyberattacks.
The infrastructure behind these intrusions traced back to a critical zero-day vulnerability tracked as CVE-2026-35273 within Oracle’s PeopleSoft, a widely deployed software-as-a-service platform utilized by corporate giants globally for human resources, recruitment, benefits, and payroll management. Although Oracle moved quickly to patch the flaw after ShinyHunters began mass exploitation in June, and Mandiant subsequently issued protective web application firewall rules, the threat actors demonstrated persistent agility. When standard mitigation strategies proved difficult for organizations to deploy instantaneously, the hackers bypassed Mandiant’s recommended defenses by weaponizing a well-known URL-encoding trick.
A comprehensive threat intelligence report released on September 25 by Mandiant and the Google Threat Intelligence Group confirmed that ShinyHunters had leveraged the PeopleSoft exploit to compromise dozens of enterprise networks spanning higher education, technology, healthcare, agriculture, transportation, and government sectors. The fallout extended directly to federal infrastructure; Reuters reported that the FBI was forced to terminate an Accenture contractor after the firm failed to patch the specific recruitment portal compromised by the hackers, exposing sensitive details—including unit assignments, specializations, and medical records—pertaining to more than 5,000 bureau personnel.
“Rey” Means King, As in Royal
According to two independent sources close to the unfolding international investigation, the digital navigation and aviation unit recently spun off by Boeing was a primary target of ShinyHunters’ extortion efforts at the exact moment Rey was apprehended by authorities in Jordan.
The attempted shakedown of the former Boeing asset injected a profound sense of urgency into the FBI’s pursuit of the group. Investigators noted that the stolen data included sensitive proprietary documentation that posed severe operational safety and security risks.
In an official statement provided to security researchers, Boeing acknowledged the attempted extortion targeting information associated with Jeppesen ForeFlight, a specialized navigation subsidiary that Boeing sold in November 2025 to private equity firm Thoma Bravo for $10.55 billion.
“We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight,” a Boeing spokesperson stated. “Estamos actively reviewing the matter with the Jeppesen ForeFlight team.”
Representatives for Jeppesen ForeFlight maintained that their proactive defense measures successfully neutralized the threat. In a written response, the subsidiary asserted that an internal investigation revealed zero impact on ongoing operations or commercial products.
Rey’s alleged involvement in the Jeppesen ForeFlight extortion plot draws additional scrutiny due to compelling evidence linking his family to Royal Jordanian Airlines, a government-influenced carrier operating long-haul routes aboard Boeing aircraft. While Rey claimed on Telegram early last year that his father worked as an airline pilot, those assertions could not be independently verified at the time. However, a deep dive into an infostealer malware infection that compromised the Khader family’s shared computer revealed that Rey’s father utilized identical login credentials across multiple administrative portals designated for Royal Jordanian Airlines personnel.
Neither Royal Jordanian Airlines nor the Khader family responded to requests for comment. Shortly after security researchers notified Rey’s father regarding his son’s illicit digital activities, Rey systematically deleted his various social media footprints, including the Twitter/X account used to mock the FBI and corporate victims.
Despite the digital purge, Rey’s technical blog hosted on GitHub remained online. A lengthy investigative post published on the blog in March 2026 unmasked two Russian nationals alleged to be the core developers and masterminds behind the Cl0p ransomware operation, demonstrating Rey’s broader obsession with exposing elite cybercrime figures.
Murder for Hire Allegations
While the investigation into the young Jordanian hacker unfolded, shocking developments emerged from the Netherlands concerning the associates of Pepijn van der Stap. Dutch daily newspaper RTL reported on September 29 that investigators harbor grave suspicions that Van der Stap attempted to orchestrate at least two contract murders to be carried out abroad, pointing to intelligence indicating he directly commissioned the violent plots.
Van der Stap had recently returned to society after serving the majority of a four-year prison sentence handed down for historic data theft and extortion schemes that prosecutors estimated yielded between 1.5 million and 2.7 million euros. Just prior to his dramatic September 15 rearrest—which local media reported involved the deployment of flash-bang grenades by specialized tactical police units—Van der Stap had positioned himself as a reformed character, securing employment as the “offensive security lead” at Amsterdam-based cybersecurity firm Neo Security.
Benjamin Korper, the owner of Neo Security, confirmed that an independent forensic auditing firm was retained to investigate whether Van der Stap had leveraged his position to compromise the firm or its client base. Initial reviews yielded no evidence of internal compromise, though Dutch law enforcement thoroughly searched the company’s facilities during the raid.
Before his initial 2023 conviction, Van der Stap maintained a dual existence, working as a software engineer for Amsterdam cybersecurity startup Hadrian and volunteering with the Dutch Institute for Vulnerability Disclosure while simultaneously executing extortion campaigns against major commercial targets.
When questioned about how the public or victims could trust a self-proclaimed reformed criminal who maintained a complex web of deception for years, Van der Stap defended his rehabilitation trajectory. “You can throw a bunch of nice words at someone, but you can’t convince them if they don’t want to be convinced,” he remarked prior to his arrest. “I’m doing what I can to repay victims, and that’s all I can do.”
Franchising and Burning a Brand
Cybersecurity analysts note that the modern iteration of ShinyHunters bears little resemblance to the original French nationals who founded the brand around 2019 and subsequently faced arrest and imprisonment. Instead, the moniker has evolved into an illicit franchise model.
Security experts compare the operational structure to the legendary “Dread Pirate Roberts” persona, where succession is dictated not by death, but by law enforcement intervention, often resulting in multiple individuals operating under the banner simultaneously. Federal investigators have concentrated their efforts on tracking freelance affiliates who acquire stolen enterprise SaaS credentials and feed them to decentralized collectives in exchange for a percentage of subsequent ransom payouts.
Following the news of Van der Stap’s arrest, underground Telegram channels allegedly managed by Rey became arenas of intense backlash. Rival cybercriminals mocked the teenager after he backed down from public threats directed at the FBI and Cl0p, a retreat that coincided with the sudden offline status of the official ShinyHunters darknet portal. Commentators accused Rey of purchasing historical forum credentials and resurrecting defunct infrastructure purely to pad his own pockets.
“He bought the old forum PGP key and used it to make new Breachforum websites and Telegram channels larping as ShinyHunters to ransom companies and then sell the used data or resell his forum when he goes broke,” one community member observed.
A dedicated monitoring channel on Telegram known as “The Battle” relentlessly doxed and ridiculed Rey and his associates, portraying the young hacker as an inexperienced opportunist riding the coattails of a tarnished brand. According to channel administrators, Rey’s unauthorized use of the ShinyHunters name generated over $200 million in calculated corporate damages while netting substantial financial cuts for a small circle of allied scammers.
In an interview with industry media, representatives for the active ShinyHunters collective claimed their cyberattacks against federal infrastructure were engineered specifically to counter an official FBI flash notice published in May. That federal advisory warned organizations against paying ransoms and detailed aggressive harassment tactics employed by the group, including threatening phone calls, swatting incidents, and false assertions regarding the possession of sensitive personal media.
While the hackers argued that breaching high-profile systems served as a necessary marketing initiative to repair their commercial reputation following the government warnings, the unfolding arrests in Amman and Amsterdam suggest that the international dragnet continues to dismantle the network’s leadership tier piece by piece.
