A teenage resident of Amman, Jordan, suspected of orchestrating high-profile data theft and extortion campaigns under the banner of the prolific cybercrime collective ShinyHunters, has been detained by local authorities and is reportedly cooperating with the Federal Bureau of Investigation (FBI).
According to investigative reporting by KrebsOnSecurity, the suspect—who operates online under the hacker handle “Rey”—was apprehended just as the cybercrime group was actively attempting to extort a recently divested business unit of global aerospace giant Boeing. Intriguingly, the suspect’s father is employed by Royal Jordanian Airlines, a carrier whose long-haul fleet consists of passenger aircraft built by Boeing, establishing a curious nexus between the family’s background and the hacker’s targets.
Initial reports of the detention emerged when Reuters cited three unnamed sources confirming that a Jordanian national named Saif Al-din Khader had been taken into custody by local law enforcement and was actively assisting the FBI. KrebsOnSecurity had previously identified Rey as Khader in a November 2025 investigative profile, during which the young man openly acknowledged collaborating with multiple distinct ransomware operations.
Rey’s activities captured renewed global attention following a September 28 exclusive detailing the arrest of 24-year-old Dutch cybercriminal Pepijn van der Stap by Dutch police. Van der Stap, a convicted felon suspected of aiding ShinyHunters in various data thefts and extortion schemes, was apprehended on the evening of September 15. Immediately following the Dutchman’s arrest, Rey assumed control of the ShinyHunters persona and brand, launching a public campaign boasting about the theft of sensitive data from the FBI and the subsequent extortion of the notorious ransomware syndicate Cl0p.
Operating via his long-standing account on Twitter/X, Rey taunted both the FBI and Cl0p using a series of internet memes. He strategically incorporated imagery of the avatar associated with Van der Stap’s former hacker moniker, “Umbreon,” in an apparent maneuver to implicate the Dutch national in the recent wave of high-profile cyberattacks.
The security breaches orchestrated by ShinyHunters relied heavily on the mass exploitation of a critical vulnerability, tracked as CVE-2026-35273, affecting PeopleSoft. This software-as-a-service platform, developed by tech titan Oracle, is widely utilized across the corporate sector for managing human resources, payroll, employee benefits, and recruitment operations. Oracle moved swiftly to release a security update addressing the zero-day flaw, which ShinyHunters had begun actively weaponizing as early as June. Simultaneously, cybersecurity firm Mandiant issued web application firewall (WAF) rules designed to protect organizations unable to apply the official patch immediately.
While initial statements from ShinyHunters to tech publication BleepingComputer indicated that the primary objective of the PeopleSoft exploits was breaching the FBI’s internal recruitment database—an attempt that initially stalled—the group later pivoted. In subsequent weeks, the hackers successfully bypassed Mandiant’s recommended WAF protections by employing a well-known URL-encoding technique.
A comprehensive threat intelligence report published jointly on September 25 by Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters had carried out a mass exploitation campaign targeting the PeopleSoft vulnerability. The attacks compromised dozens of corporate and institutional systems across diverse sectors, including higher education, technology, healthcare, agriculture, transportation, and government agencies.
Further compounding the fallout, Reuters reported on October 5 that the FBI had dismissed an external contractor stationed at Accenture following revelations of a security lapse. The contractor reportedly failed to properly patch the specific FBI recruitment portal that was subsequently compromised by ShinyHunters, resulting in the unauthorized exposure of sensitive personnel records belonging to more than 5,000 FBI employees, including specialized unit assignments, psychiatric evaluations, and medical histories.
‘Rey’ Means King, as in Royal
Sources familiar with the ongoing international investigation into ShinyHunters revealed that among the primary targets of the group’s extortion plots at the time of Rey’s arrest was a digital navigation and aviation business unit divested by Boeing. The inclusion of this aviation subsidiary elevated the urgency of the FBI’s investigation, given that the compromised data allegedly contained proprietary information presenting distinct operational safety and commercial security risks.
In a brief statement provided to security researchers, Boeing acknowledged being aware of the extortion attempts directed against data originating from Jeppesen ForeFlight. Boeing had previously sold the subsidiary in November 2025 to private equity firm Thoma Bravo in a transaction valued at $10.55 billion.
"We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight," a Boeing spokesperson stated, adding that the corporation is actively reviewing the incident alongside the Jeppesen ForeFlight security team. Representatives for Jeppesen ForeFlight maintained that their internal investigation found no adverse effects on their infrastructure, emphasizing that operations and products remained entirely unaffected.
The convergence of Rey’s arrest and the targeting of a Boeing-related entity drew immediate scrutiny due to his familial ties. Evidence uncovered during previous digital forensic analysis indicated that Rey’s father utilized personal login credentials associated with Royal Jordanian Airlines across multiple employee portals on a shared family computer—a system that had previously been compromised by password-stealing malware.
Although Royal Jordanian Airlines did not respond to formal requests for comment, outreach to Rey’s family prior to a late-September publication prompted immediate defensive maneuvers online. Hours after investigators contacted the household, Rey began systematically purging his social media footprint, scrubbing the Twitter/X accounts previously used to mock law enforcement, ransomware operators, and corporate victims.
Despite the social media deletion spree, a cybersecurity blog maintained by Rey on GitHub remained accessible. The archive featured an exhaustive post from March 2026 that effectively doxed two Russian nationals identified as the core developers and operational masterminds behind the Cl0p ransomware operation.
Murder-for-Hire Allegations Surface in the Netherlands
While the investigation into the younger hacker progressed in the Middle East, Dutch media outlets brought forth explosive allegations concerning Pepijn van der Stap. Despite widespread public media narratives focusing on his purported rehabilitation following a prior prison sentence for data theft and extortion—crimes prosecutors stated generated between €1.5 million and €2.7 million—Dutch daily RTL reported on September 29 that investigators now suspect Van der Stap attempted to orchestrate at least two murders abroad.
Prior to his dramatic September 15 arrest by a specialized Dutch police unit utilizing flash-bang grenades, Van der Stap had secured employment as an "offensive security lead" at Amsterdam-based cybersecurity firm Neo Security. Company owner Benjamin Korper confirmed that an independent forensic auditing firm was retained to investigate whether Van der Stap had compromised Neo Security or any of its clientele, though initial reviews found no evidence of internal sabotage.
Before his initial 2023 conviction, Van der Stap had worked as a software engineer for local cybersecurity startup Hadrian while volunteering with the Dutch Institute for Vulnerability Disclosure (DIVD), all while covertly conducting extortion campaigns against major international targets. When interviewed regarding skepticism surrounding his reformed status, Van der Stap maintained that his technical contributions and efforts to repay victims should speak for themselves.
Franchising and Burning a Brand
Security analysts note that while individuals operating under the ShinyHunters moniker have been linked to massive data breaches spanning billions of records since 2019, the current generation of threat actors has little connection to the group’s original French core members, many of whom have previously faced arrest and imprisonment.
Instead, modern iterations of ShinyHunters function similarly to a franchise model. Observers liken the succession structure to the literary concept of the Dread Pirate Roberts, where the identity is passed down through successive operators—or, in this case, successive arrests—allowing multiple independent affiliates to utilize the brand simultaneously. The FBI’s current investigative focus centers on a network of freelance cybercriminals who acquire and supply stolen credentials for corporate SaaS platforms in exchange for a percentage of subsequent extortion payouts.
Following the news of Van der Stap’s detention, discussions erupted within underground Telegram channels previously administered by Rey. Participants openly mocked the teenager after he walked back threats against the FBI and Cl0p, a retreat that coincided with the sudden offline status of the ShinyHunters darknet portal. Commentators accused Rey of appropriating the dormant hacker brand to inflate his own status, noting that he had purchased legacy forum PGP keys to launch derivative websites and Telegram channels designed to pressure corporate victims and resell harvested data.
A specialized Telegram tracking channel dubbed "The Battle" dedicated weeks to doxing and ridiculing Rey and his associates. Administrators of the channel characterized Rey as an inexperienced newcomer attempting to capitalize on a notorious cybercrime legacy.
"Rey made a serious mistake when he started pretending to be a member of ShinyHunters," channel administrators wrote, noting that the original syndicate had largely been dismantled by law enforcement before Rey began utilizing the alias to broker extortion deals and secure financial cuts for allied hacker circles.
The group’s operational motivations were further highlighted in interviews given by ShinyHunters representatives to industry publications. The actors claimed their cyberattacks against the FBI were launched explicitly to counter an official public service announcement published by the bureau in May 2026, which advised organizations against yielding to ransom demands. While acknowledging that the FBI’s advisory ultimately hampered their ability to successfully coerce victims into paying, the hackers characterized the high-profile breach as an aggressive public relations maneuver designed to reassert their operational capabilities in the face of negative publicity.
