A teenage cybercriminal from Amman, Jordan, suspected of orchestrating the operations of the prolific data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with federal law enforcement. According to reporting from KrebsOnSecurity, the suspect—who operates online under the hacker handle "Rey"—was taken into custody just as the hacking collective was in the midst of extorting a prominent business unit recently divested by global aerospace giant Boeing.
The investigation has taken a complex international turn, intersecting with the aviation industry through a curious personal connection: the employer of Rey’s father is Royal Jordanian Airlines, a carrier that operates a long-haul fleet built entirely by Boeing.
The initial confirmation of the arrest emerged when Reuters cited three confidential sources indicating that a suspected ShinyHunters operative named Saif Al-din Khader had been detained in Amman and was actively assisting the FBI. This aligned with a detailed profile published by KrebsOnSecurity in November 2025, which had previously identified Khader as "Rey"—a young individual who had freely admitted to maintaining active associations with multiple digital extortion and ransomware operations.
The scrutiny surrounding Rey intensified following an exclusive report on the Dutch police arrest of 24-year-old convicted cybercriminal Pepijn van der Stap. Authorities detained Van der Stap on suspicion of facilitating data thefts and extortion schemes on behalf of ShinyHunters. Investigators noted that immediately following Van der Stap’s arrest on the evening of September 15, Rey assumed de facto control of the ShinyHunters brand, taking to social media to publicly boast about infiltrating highly sensitive systems belonging to the FBI and launching extortion attempts against the rival Cl0p ransomware organization.
To mock law enforcement and rival syndicates alike, Rey uploaded a series of taunting memes to his long-standing Twitter/X account. Ingeniously malicious in his execution, he embedded images of the digital avatar utilized by Van der Stap during his former tenure under the hacker alias "Umbreon," an apparent maneuver designed to frame the Dutch national for the fresh wave of high-profile cyberattacks.
Underpinning these disruptive operations was a widespread software vulnerability. As security researchers documented, ShinyHunters managed to breach the FBI’s recruitment portal and various other corporate victims by exploiting a critical zero-day vulnerability, designated as CVE-2026-35273, found within Oracle PeopleSoft. This widely adopted software-as-a-service platform is utilized globally for managing internal corporate functions, including human resources, payroll, hiring pipelines, and employee benefits.
Oracle swiftly moved to deploy a security update after the flaw began seeing active exploitation in June. Simultaneously, cybersecurity firm Mandiant issued emergency web application firewall (WAF) rules to protect organizations unable to immediately patch their systems. Despite these defensive measures, ShinyHunters later bypassed the firewall protections by employing a classic URL-encoding trick, enabling them to sustain their mass-exploitation campaign across diverse sectors, including technology, healthcare, higher education, agriculture, transportation, and government agencies.
The fallout from these intrusions proved severe. Reuters reported that the FBI was forced to remove an Accenture contractor following a damaging data breach on the bureau’s recruitment portal. That specific incident compromised sensitive records pertaining to more than 5,000 FBI personnel, exposing unit assignments, functional specializations, and confidential medical and psychiatric documentation.
‘Rey’ Means King, as in Royal
According to two independent sources familiar with the ongoing international investigation into ShinyHunters, the group’s focus had shifted heavily toward corporate extortion. At the moment Jordanian authorities apprehended Rey, the syndicate was actively attempting to squeeze a digital aviation and navigation unit previously owned by Boeing.
This attempted shakedown prompted an escalation of urgency within the FBI’s cyber division. The targeted enterprise held sensitive operational data that investigators feared could present tangible safety and aviation security risks if leaked or mishandled.
Boeing formally acknowledged the extortion attempts in a statement provided to KrebsOnSecurity, clarifying that the targeted data belonged to Jeppesen ForeFlight. Boeing had previously divested the subsidiary in November 2025, selling it to private equity firm Thoma Bravo in a transaction valued at $10.55 billion.
"We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight," a Boeing spokesperson noted, adding that the corporation was actively coordinating a review with the Jeppesen ForeFlight security team. Representatives for Jeppesen ForeFlight similarly asserted that their proactive security posture shielded them from operational damage, confirming that internal investigations revealed no impact on ongoing products or daily workflows.
The operational backdrop of Rey’s arrest carries notable circumstantial parallels. Strong investigative indicators suggest that Rey’s father is employed by Royal Jordanian Airlines, a national carrier primarily controlled by the Jordanian government that relies heavily on Boeing passenger aircraft for its international routes. While initial claims floated by Rey on Telegram in early 2025 describing his father as an airline pilot could not be independently verified, forensic data told a more concrete story.
When a family computer used by the household was compromised by password-stealing malware, forensic artifacts revealed that Rey’s father had repeatedly utilized identical login credentials across various official online portals dedicated to Royal Jordanian Airlines employees.
Royal Jordanian Airlines has not issued a formal response to inquiries regarding the security incident. Furthermore, shortly after KrebsOnSecurity reached out to Rey’s father prior to a late September report to apprise him of his son’s alleged illegal activities, digital traces of the teenager began vanishing. Rey systematically deleted his social media footprint, including the primary Twitter/X profile he had used to harass federal investigators and rival hackers.
Despite the purge of his social platforms, Rey’s technical blog hosted on GitHub remained active, revealing a distinct obsession with the operational leadership of the Cl0p ransomware gang. In March 2026, the blog published an extensive investigative post that successfully doxxed two Russian nationals alleged to be the core developers and masterminds behind the Cl0p enterprise.
Murder for Hire Allegations
While federal authorities interrogated suspects in the Middle East, Dutch media outlets broke explosive revelations regarding Pepijn van der Stap. Van der Stap had cultivated a public persona as a reformed hacker who had successfully transitioned into legitimate corporate security, even securing a role as an "offensive security lead" at a Dutch cybersecurity firm known as Neo Security.
However, Dutch daily newspaper RTL reported that investigators harbor strong suspicions that Van der Stap attempted to orchestrate at least two murders. According to the reports, the planned homicides were intended to take place abroad, with investigators uncovering evidence suggesting Van der Stap directly commissioned the violent acts.
Van der Stap’s criminal history included serving the majority of a four-year prison sentence handed down for historic data theft and extortion campaigns that prosecutors estimated generated between €1.5 million and €2.7 million in illicit proceeds. Following his release, he managed to secure employment probing corporate networks for vulnerabilities, a transition that drew widespread attention across the tech sector.
Following Van der Stap’s dramatic pre-dawn arrest on September 15—which local media reported involved the tactical deployment of flash-bang grenades by Dutch special units—Neo Security’s owner, Benjamin Korper, announced that an independent third-party firm had been retained to audit the company’s systems. Korper confirmed that investigators had found zero evidence indicating Van der Stap had compromised his employer or its client base during his brief tenure.
Before his initial 2023 conviction, Van der Stap maintained a dual existence. He worked as a software engineer for an Amsterdam-based cybersecurity startup while volunteering for the Dutch Institute for Vulnerability Disclosure, all while covertly infiltrating corporate networks. Confronted regarding the inherent difficulties of convincing the public of his rehabilitation given his history of deception, Van der Stap maintained that his technical contributions would ultimately define his legacy.
"You can throw a bunch of nice words at someone, but you can’t convince them if they don’t want to be convinced," Van der Stap stated prior to his second arrest. "I’m doing what I can to repay victims, and that’s all I can do."
Franchising and Burning a Brand
The broader ShinyHunters collective has been tied to dozens of massive data breaches compromising billions of user records in operations tracing back to 2019. Cybersecurity analysts emphasize, however, that the individuals currently operating under the banner bear little operational connection to the original core members—most of whom are French nationals who have faced arrest and imprisonment for their roles in historic cybercrime rings.
Instead, security researchers characterize modern iterations of ShinyHunters as a decentralized franchise model. Operating similarly to the conceptual "Dread Pirate Roberts" lineage from popular culture, succession within the cybercrime ecosystem is dictated by law enforcement arrests rather than mortality, frequently allowing multiple individuals to claim the moniker simultaneously. Federal investigators are increasingly focusing their efforts on independent freelancers and affiliates who supply stolen software credentials to the core brand in exchange for a percentage of subsequent extortion payouts.
In the wake of Van der Stap’s arrest and Rey’s subsequent detention, chat servers dedicated to cybercrime on Telegram erupted into internal conflict. Commentators ridiculed Rey for rapidly walking back his public threats against the FBI and the Cl0p syndicate, particularly as the group’s darknet leak sites abruptly vanished offline following federal ultimatums.
Observers within underground forums accused Rey of co-opting the legacy ShinyHunters brand simply to drive personal profit. According to underground chat logs, the teenager acquired historical PGP keys and established unauthorized forum instances and Telegram channels to independently extort corporate victims, subsequently attempting to monetize or liquidate the stolen datasets.
A specialized Telegram tracking channel known as "The Battle" dedicated weeks to doxxing and ridiculing Rey and his associates, characterizing the young hacker as an inexperienced opportunist riding the coattails of a notorious brand. Forum administrators noted that while Rey may have generated significant digital disruption and negotiated side deals across various affiliated cells, his adoption of the legacy name ultimately invited intense law enforcement scrutiny that dismantled his operations.
The group’s public friction with law enforcement ultimately culminated in a bizarre public relations strategy. In an interview with industry media, representatives for ShinyHunters claimed their decision to breach federal recruitment systems was intentionally designed to counter public warnings issued by the FBI.
The FBI had previously released a flash advisory cautioning organizations against yielding to extortion demands. The advisory highlighted the group’s aggressive intimidation tactics, which historically ranged from threatening phone calls and text messages directed at executives and their families to malicious swatting incidents. The federal notice further warned that the syndicate frequently fabricated claims regarding the possession of sensitive or embarrassing personal media to coerce victims into compliance.
While ShinyHunters leadership asserted that their targeted digital retaliation served as an effective marketing initiative to safeguard their illicit business model, the subsequent arrests in Jordan and the Netherlands underscore the growing vulnerability of decentralized cybercriminal syndicates to coordinated global law enforcement pressure.
