A teenager from Amman, Jordan, suspected of leading the prolific and destructive data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the FBI to help law enforcement identify other members of the international hacking collective.
According to investigative reporting by KrebsOnSecurity, the suspect—who operates online under the hacker handle "Rey"—was apprehended just as ShinyHunters was actively engaged in extorting a business unit recently divested by global aerospace giant Boeing. In a striking personal intersection, this targeted business unit manufactures aviation fleets used by the employer of Rey’s father, Royal Jordanian Airlines.
The detention follows a flurry of international law enforcement actions and high-profile cyberattacks that have placed the reborn extortion group squarely in the crosshairs of global cybersecurity agencies. On October 3, Reuters cited three unnamed sources confirming that a suspected ShinyHunters member in Amman named Saif Al-din Khader had been detained by Jordanian authorities and was actively assisting the FBI. KrebsOnSecurity had previously identified Rey as Khader in a November 2025 profile, during which the young man openly admitted to collaborating with multiple ransomware operations.
Rey’s name surfaced again prominently in a September 28 investigative report detailing the arrest of 24-year-old Dutch cybercriminal Pepijn van der Stap by Netherlands police. Van der Stap, a convicted felon, was suspected of aiding ShinyHunters in their ongoing data theft and extortion campaigns. Security researchers noted that immediately following the Dutchman’s arrest on the evening of September 15, Rey seized control of the volatile ShinyHunters brand. Capitalizing on the sudden vacancy, he began publicly boasting about stealing highly sensitive data from the FBI and extorting the rival ransomware group Cl0p.
In an effort to mock law enforcement and rival cybercriminals alike, Rey taunted both the FBI and Cl0p by posting a series of memes to his long-standing Twitter/X account. At the same time, he strategically included images of the avatar utilized by Van der Stap’s former hacker alias, "Umbreon," in an apparent, calculated attempt to frame the Dutch national for both high-stakes hacks.
The wave of breaches engineered by the group relied heavily on a critical software vulnerability. As detailed in previous security advisories, ShinyHunters gained unauthorized access to the FBI’s recruitment website and numerous other corporate victims by exploiting CVE-2026-35273. This severe vulnerability existed within PeopleSoft, a widely deployed enterprise software-as-a-service platform from tech giant Oracle used universally for human resources management, payroll, and hiring processes.
Oracle swiftly issued a security patch after ShinyHunters began weaponizing the flaw as a zero-day exploit in June. Concurrently, cybersecurity firm Mandiant released specialized web application firewall (WAF) rules to protect organizations unable to immediately apply the software update.
Initial communications from the hackers indicated that their primary target was the FBI’s own internal PeopleSoft database, though those initial attempts reportedly encountered obstacles. In subsequent weeks, however, the group circumvented protective measures by employing a well-known URL-encoding trick to bypass Mandiant’s recommended WAF rules.
A comprehensive threat intelligence report released on September 25 by Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters had mass-exploited the PeopleSoft vulnerability. The campaign successfully compromised data across dozens of corporate systems spanning diverse sectors, including higher education, technology, healthcare, agriculture, transportation, and government agencies.
The fallout from these breaches has been severe. Reuters reported on October 5 that the FBI dismissed an IT contractor working through Accenture following revelations of a failure to patch the compromised recruitment portal. That specific breach exposed sensitive, confidential records pertaining to more than 5,000 FBI personnel, including individual unit assignments, professional specializations, and private medical and psychiatric documentation.
‘Rey’ Means King, as in Royal
According to two independent sources close to the international investigation, a digital aviation and navigation unit recently divested by Boeing was among the primary targets being actively extorted by ShinyHunters at the exact time Rey was taken into custody by Jordanian law enforcement.
Investigators familiar with the case noted that the FBI’s pursuit of ShinyHunters intensified dramatically following the extortion attempt against the former Boeing entity. The stolen data involved in this specific breach allegedly contained proprietary information that security experts warned could pose tangible operational safety and security risks.
In a brief formal statement provided to KrebsOnSecurity, Boeing acknowledged the extortion attempts directed at its former subsidiary. The aerospace manufacturer confirmed that the incident involved data tied to Jeppesen ForeFlight, a specialized navigation unit that Boeing sold in November 2025 to private equity firm Thoma Bravo for $10.55 billion.
"We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight," a Boeing spokesperson stated, adding that corporate security teams were actively reviewing the situation alongside personnel from Jeppesen ForeFlight.
A representative for Jeppesen ForeFlight issued a written response indicating that internal systems remained secure. "Based on our investigation to date into this claim and proactive security posture, there was no impact to our operations or products," the company stated.
Rey’s alleged role in targeting the former Boeing subsidiary carries a notable personal irony, given substantial evidence indicating his father is employed by Royal Jordanian Airlines. The airline, primarily controlled by the Jordanian government, operates long-haul passenger flights exclusively utilizing Boeing aircraft. While Rey claimed on Telegram in early 2025 that his father worked as an airline pilot, that specific detail could not be independently verified.
However, forensic evidence from a previous cybersecurity profile revealed that a shared family computer utilized by the Khaders had been compromised by password-stealing malware. Data extracted by the malware showed Rey’s father repeatedly using identical login credentials across various administrative portals for Royal Jordanian Airlines employees.
Royal Jordanian Airlines has not yet responded to formal requests for comment regarding the incident. Prior to publishing their late-September exposés, investigators attempted to contact Rey’s father directly to apprise him of his son’s cybercriminal activities. While neither family member responded, the digital footprint shifted almost immediately: hours after the inquiry was sent, Rey began systematically deleting his extensive social media presence, including the Twitter/X handle he used to mock federal investigators and rival hackers.
Despite purging his primary social media accounts, Rey’s technical blog hosted on GitHub remained active. The posts revealed an intense fixation on the leadership of the Cl0p ransomware operation. A lengthy analysis published on the blog in March 2026 attempted to unmask two Russian nationals alleged to be the core developers and masterminds behind Cl0p, one of the oldest active ransomware syndicates in operation.
Murder for Hire Allegations
Meanwhile, criminal investigations in the Netherlands have surfaced explosive new allegations against Van der Stap, whose narrative of personal rehabilitation after a previous conviction had previously garnered sympathetic coverage in technical media circles. Dutch daily newspaper RTL reported on September 29 that investigators suspect Van der Stap attempted to orchestrate at least two contract murders. According to the reporting, the targeted attacks were planned to take place abroad, and authorities uncovered concrete indications that Van der Stap issued the directives.
Van der Stap had recently completed the majority of a four-year prison sentence for data theft and extortion. Prosecutors estimated his previous cybercrime network had generated between 1.5 million and 2.7 million euros in illicit proceeds. In an interview conducted on September 9, Van der Stap claimed to have reformed, describing his new professional role as an "offensive security lead" at Dutch cybersecurity firm Neo Security, where he ostensibly tested client networks for vulnerabilities.
Benjamin Korper, the owner of Neo Security, told Reuters that an independent outside firm had been retained to audit whether Van der Stap had compromised the company or its clients. Thus far, investigators have found no evidence of malicious activity directed against the employer. Korper confirmed that Dutch forensic police units descended upon his office on the evening of September 15, executing a dramatic raid that reportedly involved the deployment of flash-bang grenades.
Before his initial arrest in 2023, Van der Stap maintained a dual life. He worked professionally as a software engineer for Amsterdam-based cybersecurity startup Hadrian and volunteered with the Dutch Institute for Vulnerability Disclosure (DIVD), all while covertly breaking into and extorting major corporate entities.
When questioned about how the public or employers could trust a self-described reformed criminal who had successfully deceived colleagues and journalists for years, Van der Stap maintained that his actions would ultimately speak for themselves. "You can throw a bunch of nice words at someone, but you can’t convince them if they don’t want to be convinced," he remarked during the September interview. "I’m doing what I can to repay victims, and that’s all I can do."
Franchising and Burning a Brand
Cybercriminals operating under the ShinyHunters banner are tied to dozens of massive data breaches compromising billions of records in campaigns stretching back to 2019. Security experts emphasize, however, that the individuals controlling the moniker today bear little relation to the group’s original core members, most of whom are French citizens who have previously faced arrest and imprisonment for cyber offenses.
Instead, ShinyHunters has evolved into an informal criminal franchise. Security analysts liken the operational structure to the fictional character Dread Pirate Roberts from the classic film The Princess Bride, where succession is determined by law enforcement arrests rather than death, allowing multiple individuals to operate under the same legendary handle simultaneously. Current federal investigations are heavily focused on a small circle of freelance cybercriminals who feed stolen SaaS platform credentials to affiliates in exchange for a percentage of subsequent ransom payments.
In the aftermath of Van der Stap’s arrest, underground Telegram channels operated by Rey became arenas for intense backlash. Fellow cybercriminals ridiculed the teenager after he publicly retreated from his threats against the FBI and Cl0p, particularly as the primary ShinyHunters darknet portal abruptly went offline. Commentators accused Rey of appropriating a historic cybercrime brand to run individual extortion scams before attempting to monetize the associated infrastructure.
"He bought the old forum PGP key and used it to make new Breachforum websites and Telegram channels larping as ShinyHunters to ransom companies and then sell the used data," one underground forum member noted.
A specialized Telegram channel titled "The Battle" has spent weeks doxing and criticizing Rey and other affiliates, gaining substantial traction within underground messaging communities. Channel administrators argued that Rey fundamentally miscalculated by associating with a burned brand name.
"Rey made a serious mistake when he started pretending to be a member of ShinyHunters," the administrators wrote, noting estimates that his activities generated significant disruption while lining the pockets of a small network of associates.
In an interview with The Register, representatives for the hacking collective claimed their decision to breach the FBI was a calculated countermeasure designed to undermine a public advisory published by the agency on May 15. That official flash notice warned corporations against yielding to extortion demands and detailed harassment tactics utilized by the group, including threatening phone calls, text messages, and swatting incidents directed at victims and their families. The FBI warning also cautioned that the hackers frequently bluff about possessing sensitive photographic or video media.
The hackers asserted that targeting federal infrastructure was a necessary public relations move to reassert their technical prowess and counter what they characterized as agency misinformation. At the same time, the group tacitly admitted that the federal warning severely damaged their extortion prospects, proving that the high-profile digital clashes served as much as a marketing battle as a financial enterprise.
