A teenager from Amman, Jordan, suspected of leading the prolific data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the FBI to identify other members of the notorious hacking gang.
According to intelligence gathered by KrebsOnSecurity, the suspect—who operates under the hacker handle “Rey”—was taken into custody just as the criminal collective was actively attempting to extort a business unit recently divested by global aerospace giant Boeing. In a striking coincidence underscoring the interconnected nature of modern cybercrime, the targeted Boeing entity manufactures the fleet of aircraft utilized by Royal Jordanian Airlines, the employer of Rey’s own father.
The international dragnet tightened significantly on October 3, when Reuters cited three unnamed sources confirming that a suspected ShinyHunters operative in Amman named Saif Al-din Khader had been detained by Jordanian authorities and was providing actionable intelligence to federal investigators. KrebsOnSecurity had previously unmasked Rey as Khader in a November 2025 investigative profile, during which the young man admitted to maintaining active associations with multiple ransomware and extortion syndicates.
Rey’s notoriety surged once again in a September 28 exclusive detailing the arrest of 24-year-old Dutch cybercriminal and convicted extortionist Pepijn van der Stap by Dutch law enforcement. Investigators suspect Van der Stap of actively aiding ShinyHunters in their widespread data theft campaigns. Cybersecurity analysts noted that immediately following the dramatic Dutch police raid on September 15, Rey seized operational control of the ShinyHunters moniker. He quickly took to public platforms to boast about breaching high-profile targets, including the FBI, and extorting the rival Cl0p ransomware organization.
In an effort to throw investigators off his trail, Rey weaponized memes posted to his long-standing Twitter/X account to taunt both federal agents and Cl0p operators. Simultaneously, he embedded images of the avatar once utilized by Van der Stap under his former hacker alias, “Umbreon,” in an explicit attempt to frame the imprisoned Dutchman for the newly launched attacks.
Security researchers revealed that ShinyHunters managed to compromise the FBI recruitment portal and numerous other high-value targets by exploiting a critical zero-day vulnerability, tracked as CVE-2026-35273, within PeopleSoft. This software-as-a-service platform, developed by tech giant Oracle, is deployed globally by corporate enterprises and government agencies to manage human resources, recruitment, payroll, and employee benefits.
Although Oracle rushed out a security patch shortly after ShinyHunters began weaponizing the flaw in June, and Mandiant released protective web application firewall (WAF) rules for organizations unable to apply immediate updates, the threat actors adapted. According to communications shared with BleepingComputer, the hackers initially targeted the FBI’s PeopleSoft infrastructure, though those initial attempts met with mixed results. Weeks later, the group bypassed Mandiant’s recommended defenses by deploying a well-known URL-encoding trick.
A comprehensive threat intelligence report published on September 25 by Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters carried out mass exploitation campaigns against the PeopleSoft vulnerability. These attacks compromised dozens of corporate and institutional systems across a diverse spectrum of sectors, encompassing higher education, technology, healthcare, agriculture, transportation, and government agencies.
Further compounding the fallout, Reuters reported on October 5 that the FBI dismissed an Accenture contractor following revelations of a severe oversight. The contractor reportedly failed to patch the very recruitment portal compromised by ShinyHunters, exposing sensitive records detailing the units, specializations, and even confidential medical and psychiatric evaluations of more than 5,000 FBI personnel.
‘Rey’ Means King, as in Royal
According to two independent sources close to the unfolding international investigation, a digital aviation and navigation unit divested by Boeing was among the primary targets currently being extorted by ShinyHunters when Jordanian authorities closed in on Rey.
Investigators confirmed that the FBI’s pursuit of the cybercriminal group accelerated dramatically following the attempted extortion of the former Boeing subsidiary. Sources warned that the stolen data included sensitive technical files capable of posing direct operational safety and security risks to aviation infrastructure.
In a statement provided to KrebsOnSecurity, Boeing acknowledged the ongoing extortion threats, confirming that the targeted information originated from Jeppesen ForeFlight. Boeing had previously sold this aviation navigation subsidiary to the private equity firm Thoma Bravo in November 2025 for $10.55 billion.
"We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight," a Boeing spokesperson stated. "Estamos actively reviewing the matter with the Jeppesen ForeFlight team."
Conversely, a representative for Jeppesen ForeFlight maintained that internal operations remained secure. "Based on our investigation to date into this claim and proactive security posture, there was no impact to our operations or products," the company said in a written response.
Rey’s alleged involvement in the aerospace extortion plot carries a compelling personal dimension. Strong evidence indicates his father is employed by Royal Jordanian Airlines, a carrier predominantly controlled by the Jordanian government that operates its long-haul fleet using commercial passenger aircraft manufactured by Boeing. While Rey claimed on Telegram in early 2025 that his father worked as an airline pilot, that specific detail could not be independently verified.
However, forensic analysis from KrebsOnSecurity’s November 2025 profile revealed that a family computer shared by the Khaders had been compromised by password-stealing malware. The harvested logs clearly demonstrated that Rey’s father utilized identical login credentials across multiple administrative portals dedicated to Royal Jordanian Airlines employees.
Royal Jordanian Airlines has not responded to multiple requests for comment. Shortly before publishing the September 28 report, investigators reached out to Rey’s father once again to apprise him of his son’s alleged illicit activities. Neither family member responded; however, within hours of that notification being sent, Rey began systematically purging his digital footprint, deleting numerous social media profiles—including the Twitter/X account used to mock federal law enforcement and corporate victims.
Despite scrubbing his mainstream social channels, Rey’s technical blog hosted on GitHub remained active. A lengthy post published on the blog in March 2026 featured a detailed doxing investigation identifying two Russian nationals as the core developers and masterminds behind the Cl0p ransomware operation.
Murder-for-Hire Allegations Surface in the Netherlands
Meanwhile, investigative reporting in the Netherlands introduced explosive new allegations against Pepijn van der Stap, whose narrative of personal redemption and post-prison professional reintegration had previously been celebrated across European tech media. Dutch daily newspaper RTL reported on September 29 that investigators suspect Van der Stap orchestrated at least two murder-for-hire plots intended to be executed abroad.
Van der Stap had recently completed the majority of a four-year prison sentence stemming from extensive data theft and extortion activities that prosecutors estimated yielded between 1.5 million and 2.7 million euros. During a September 9 interview, Van der Stap presented himself as a reformed individual, describing his new role as an "offensive security lead" at Neo Security, a Dutch cybersecurity firm where he purportedly tested client networks for vulnerabilities.
Benjamin Korper, the owner of Neo Security, told Reuters that he retained an outside forensic firm to investigate whether Van der Stap had compromised the firm or any of its clients. Initial findings yielded no evidence of malicious activity directed against the employer, though Korper confirmed that Dutch law enforcement descended on his offices on the evening of September 15, executing a high-profile raid that reportedly involved the deployment of flash-bang grenades.
Before his initial 2023 arrest, Van der Stap worked as a software engineer for Amsterdam-based cybersecurity startup Hadrian while volunteering for the Dutch Institute for Vulnerability Disclosure (DIVD)—all while secretly breaching and extorting major multinational organizations. When questioned about how the public could trust a self-described reformed hacker who had routinely deceived colleagues and researchers, Van der Stap maintained that his subsequent actions would ultimately define him.
"You can throw a bunch of nice words at someone, but you can’t convince them if they don’t want to be convinced," Van der Stap said. "I’m doing what I can to repay victims, and that’s all I can do. If someone doesn’t want to believe me, then that’s on them."
Franchising and Burning a Brand
Cybercriminals operating under the ShinyHunters banner have been linked to dozens of massive data breaches involving billions of compromised records, with operations dating back to at least 2019. Security experts emphasize, however, that the individuals currently wielding the ShinyHunters moniker bear little relation to the group’s original core members, most of whom are French nationals who have faced arrest and imprisonment for cybercrime.
Instead, ShinyHunters has evolved into an illicit franchise model. Analysts compare the dynamic to the fictional "Dread Pirate Roberts" from the classic film The Princess Bride, where succession occurs not through biological lineage or death, but through the arrest of the current brand holder, often resulting in multiple individuals claiming the mantle simultaneously. Law enforcement sources indicate that the FBI is currently focusing its efforts on a residual network of freelance affiliates who supply stolen software credentials in exchange for a percentage of subsequent extortion payouts.
Following the news of Van der Stap’s arrest, underground Telegram channels allegedly managed by Rey became a battleground of intense ridicule. Participants mocked the teenage hacker after he abruptly retreated from public threats against the FBI and Cl0p, a retreat compounded when the primary ShinyHunters darknet portal abruptly went offline. Commentators accused Rey of appropriating the defunct group’s legacy for personal financial gain.
"He bought the old forum PGP key and used it to make new Breachforum websites and Telegram channels larping as ShinyHunters to ransom companies and then sell the used data or resell his forum when he goes broke," one community member noted.
A competing Telegram channel titled "The Battle" has spent weeks doxing and criticizing Rey and other alleged associates, attracting a substantial following among underground cybercrime forums. Administrators of the channel accused Rey of exploiting a famous brand name without possessing the operational discipline of its predecessors.
"Rey (Saif Al-Din Khader) made a serious mistake when he started pretending to be a member of ShinyHunters," wrote the channel’s administrators. "That group had already been dismantled, with many of its members either arrested or imprisoned, yet Rey still chose to use its name while carrying out his crimes."
In an interview with The Register, representatives operating under the ShinyHunters banner claimed that their high-profile assault on the FBI was designed to counter an agency public safety advisory issued in May 2026, which formally warned victims against paying ransoms to the group. The FBI’s advisory highlighted aggressive extortion tactics employed by the network, including persistent harassment, threatening phone calls, and physical swatting attacks against executives and their families.
While the hackers asserted that their breach of federal infrastructure was executed to demonstrate technical superiority and counter public skepticism, industry observers noted that the aggressive publicity ultimately galvanized law enforcement coordination, accelerating the downfall of both Rey and his international co-conspirators.
