A teenage resident of Amman, Jordan, suspected of orchestrating high-profile data theft and extortion campaigns under the banner of the notorious cybercrime syndicate ShinyHunters, has been detained by local authorities and is reportedly cooperating with the FBI. According to reports from investigative journalist Brian Krebs and Reuters, the suspect—who operates online under the hacker handle "Rey"—was apprehended just as the syndicate was actively attempting to extort a recently divested business unit of global aerospace giant Boeing.
The detention of the suspect, identified by KrebsOnSecurity as Saif Al-din Khader, marks a major development in an international law enforcement sweep targeting the modern iteration of ShinyHunters. Investigators say the teenager’s capture and subsequent cooperation have provided federal authorities with crucial leads to identify and dismantle other members of the sprawling hacking collective.
The Unraveling of "Rey" and the Boeing Extortion Plot
The FBI’s investigation into ShinyHunters gained significant urgency following the group’s aggressive extortion attempt against a navigation and digital aviation unit divested by Boeing. Sources close to the investigation revealed that the targeted entity was Jeppesen ForeFlight, a subsidiary that Boeing sold in November 2025 to private equity firm Thoma Bravo for $10.55 billion. The attempted extortion reportedly involved the alleged theft of sensitive digital assets that security officials feared could pose operational safety and security risks.
In statements regarding the incident, Boeing acknowledged being aware of threats from a threat actor targeting data associated with the company and its former subsidiary. Meanwhile, representatives for Jeppesen ForeFlight maintained that their internal investigation found no operational impact or compromise to their core products, owing to the company’s proactive security posture.
The timing of Khader’s arrest in Amman carries an ironic twist. Sources familiar with the case noted that the teenager’s father is employed by Royal Jordanian Airlines, a carrier largely controlled by the Jordanian government that operates its long-haul fleet on Boeing-manufactured aircraft. Although early 2025 Telegram posts by Khader claiming his father was an airline pilot could not be independently verified, a previous cybersecurity profile of Rey revealed that his family’s shared computer had been compromised by password-stealing malware. Data harvested during that breach showed the suspect’s father utilizing identical credentials across multiple online portals for Royal Jordanian airline employees.
When contacted for comment ahead of previous reporting, neither Khader nor his father responded. However, digital trails indicate that shortly after inquiries were sent to the household, the younger Khader began systematically purging his social media profiles, including the Twitter/X account he frequently used to taunt law enforcement and rival cybercrime organizations. Despite scrubbing most of his online footprint, a cybersecurity blog maintained by Rey on GitHub remained active, featuring a detailed post from March 2026 that doxxed two Russian men alleged to be the core developers and operators behind the Cl0p ransomware operation.
Exploiting Oracle PeopleSoft and Targeting the FBI
The broader law enforcement crackdown on ShinyHunters stems from a mass-exploitation campaign that began in June, leveraging a zero-day vulnerability tracked as CVE-2026-35273 within PeopleSoft, a widely utilized software-as-a-service (SaaS) platform owned by tech giant Oracle. The platform is heavily relied upon by organizations worldwide to manage human resources, recruitment, payroll, and corporate benefits.
While Oracle swiftly issued security patches and Mandiant released web application firewall (WAF) rules to mitigate the risk, ShinyHunters managed to bypass initial defenses by employing URL-encoding techniques. Security experts from Mandiant and the Google Threat Intelligence Group (GTIG) confirmed in a late September joint report that the syndicate had successfully mass-exploited the PeopleSoft vulnerability to siphon data from dozens of organizations across higher education, technology, healthcare, agriculture, transportation, and government sectors.
The group’s brazen activities included a breach of the FBI’s own recruitment platform. Reuters reported that the security lapse resulted in the removal of an Accenture contractor after the compromised database exposed sensitive records detailing the units, specializations, and medical and psychiatric evaluations of more than 5,000 FBI personnel.
The successful intrusion prompted the FBI to issue an advisory warning organizations against yielding to the group’s extortion demands. In response, members of ShinyHunters gave interviews to technology media outlets asserting that the hack against the FBI was executed to counter what they described as misinformation in the agency’s public alerts and to serve as a marketing maneuver to protect their criminal brand.
The "Dread Pirate Roberts" Model of Cybercrime Franchising
Security researchers emphasize that the individuals currently operating under the ShinyHunters banner are distinct from the syndicate’s original members, many of whom are French nationals previously apprehended for cybercrime. Instead, modern iterations of the group function similarly to a franchise model. Experts compare the operational succession to the fictional "Dread Pirate Roberts" from The Princess Bride, where continuity is maintained through decentralized affiliates rather than a single leadership structure.
In this structure, freelance cybercriminals feed stolen credentials from compromised enterprise platforms to the group in exchange for a percentage of any ransom recovered from victims. This decentralized approach, however, also leaves the brand vulnerable to internal friction and opportunistic actors.
Following the mid-September arrest of 24-year-old Dutch cybercriminal Pepijn van der Stap—who was taken into custody by Dutch police following a dramatic raid involving flash-bang grenades—Rey reportedly attempted to seize control of the ShinyHunters brand. Authorities suspect Van der Stap of assisting in previous data thefts and extortions, and Dutch media outlets subsequently reported that he is also under investigation for allegedly orchestrating two murders abroad.
During the transition of power, Rey attempted to frame Van der Stap—who formerly used the hacker alias "Umbreon"—by posting taunting memes on social media that combined references to the FBI, Cl0p, and his rival’s former avatar. The ploy backfired within underground chat communities. A Telegram channel dedicated to tracking and exposing cybercriminals began systematically doxxing Rey, accusing the teenager of riding the coattails of a depleted organization and making a mockery of its reputation.
Commentators in underground forums noted that Rey had acquired old PGP keys and forum infrastructure to larp as the legendary hacking group, utilizing its alias to negotiate ransoms and secure cut rates ranging from 25 to 30 percent for allied hacker groups. Ultimately, the combined pressure of public taunts, international investigative tracking, and coordinated leaks culminated in the teenager’s detention in Jordan.
As federal investigators continue to interview cooperators and trace the digital infrastructure used in the attacks, the collapse of Rey’s network highlights the precarious nature of cybercrime syndicates that rely on notoriety, splintered alliances, and fragmented digital identities. With key figures either imprisoned, detained, or cooperating with international law enforcement, the modern iteration of ShinyHunters faces a rapidly shrinking operational window.
