{"id":1194,"date":"2026-10-10T14:51:19","date_gmt":"2026-10-10T14:51:19","guid":{"rendered":"https:\/\/wyominginvest.com\/?p=1194"},"modified":"2026-10-10T14:51:19","modified_gmt":"2026-10-10T14:51:19","slug":"alleged-shinyhunters-leader-rey-detained-in-jordan-and-cooperating-with-fbi-amid-escalating-crackdown-on-ransomware-syndicate","status":"publish","type":"post","link":"https:\/\/wyominginvest.com\/?p=1194","title":{"rendered":"Alleged ShinyHunters Leader "Rey" Detained in Jordan and Cooperating With FBI Amid Escalating Crackdown on Ransomware Syndicate"},"content":{"rendered":"

A teenage cybercriminal from Amman, Jordan, suspected of orchestrating the operations of the prolific data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with federal investigators in the United States. <\/p>\n

According to security reporting and sources familiar with the ongoing multi-jurisdictional investigation, the suspect\u2014who operates online under the hacker handle "Rey"\u2014was apprehended just as the cybercrime group was actively attempting to extort a recently divested business unit of global aerospace giant Boeing. In an ironic twist, Boeing manufactures the commercial aircraft used by Royal Jordanian Airlines, the carrier that employs the suspect\u2019s father.<\/p>\n

The Arrest of "Rey" and the Boeing Extortion Plot<\/h2>\n

On October 3, international news agency Reuters cited three unnamed sources confirming that a suspected core member of ShinyHunters named Saif Al-din Khader had been taken into custody by Jordanian law enforcement and was actively assisting the Federal Bureau of Investigation (FBI). Investigative security journalist Brian Krebs previously identified "Rey" as Khader in a November profile, during which the young man openly admitted to collaborating with multiple ransomware operations.<\/p>\n

Rey\u2019s name surfaced once again in late September during coverage of a high-profile Dutch police raid that resulted in the arrest of 24-year-old convicted cybercriminal Pepijn van der Stap. Investigators suspect Van der Stap aided ShinyHunters in their extensive data theft and extortion campaigns. <\/p>\n

Immediately following the dramatic evening arrest of the Dutch suspect on September 15, Rey seized control of the online presence associated with the ShinyHunters brand. Operating from his channels, he publicly boasted about compromising highly sensitive data belonging to the FBI and successfully shaking down the notorious ransomware gang Cl0p. <\/p>\n

\"ShinyHunters<\/figure>\n

Rather than maintaining a low profile, Rey actively taunted both the FBI and Cl0p by circulating custom memes across his long-standing social media accounts on Twitter\/X. Within these digital taunts, he strategically embedded images of the avatar utilized by Van der Stap\u2019s former hacker alias, "Umbreon," in an apparent, calculated attempt to frame the Dutchman for the secondary wave of high-profile intrusions.<\/p>\n

The security community had been tracking the broader ShinyHunters campaign for months. As detailed in forensic intelligence reports, the group successfully compromised the FBI recruitment portal and numerous other high-value targets by exploiting a critical zero-day vulnerability tracked as CVE-2026-35273. The flaw resided within PeopleSoft, a widely deployed software-as-a-service human resources and payroll platform developed by technology titan Oracle. <\/p>\n

Although Oracle moved swiftly to patch the vulnerability after ShinyHunters began mass exploitation in June, and security firm Mandiant issued emergency web application firewall (WAF) rules for organizations unable to apply patches immediately, the syndicate proved resilient. When initial direct attempts to infiltrate the FBI\u2019s specific PeopleSoft database stalled, the group later utilized URL-encoding workarounds to bypass Mandiant\u2019s defensive controls.<\/p>\n

A threat intelligence briefing published by Google\u2019s Mandiant and Threat Intelligence Group in late September confirmed that the syndicate mass-exploited the PeopleSoft vulnerability to siphon confidential records from dozens of organizations spanning higher education, technology, healthcare, agriculture, transportation, and government sectors. Subsequent reports revealed that the FBI took internal disciplinary action, removing an Accenture contractor after investigators determined a failure to patch the compromised recruitment portal directly enabled the exposure of sensitive records concerning more than 5,000 bureau personnel, including unit specializations alongside medical and psychiatric files.<\/p>\n

"Rey" Means King, as in Royal<\/h2>\n

Investigators close to the case revealed that the FBI’s pursuit of ShinyHunters intensified dramatically when the group targeted a digital aviation and navigation unit divested by Boeing. The stolen corporate data involved in this specific extortion plot posed acute operational safety and security risks, prompting an aggressive international response.<\/p>\n

\"ShinyHunters<\/figure>\n

Boeing formally acknowledged the extortion attempts in a statement, confirming that the threat actors claimed possession of proprietary data originating from Jeppesen ForeFlight. Boeing had previously sold this subsidiary to private equity firm Thoma Bravo for $10.55 billion. While Boeing and Jeppesen ForeFlight representatives stated that ongoing investigations indicated no operational disruption or product impact resulted from the claims, the audacity of the target brought intense regulatory and law enforcement scrutiny down upon the hackers.<\/p>\n

The timing of Rey’s involvement in the Jeppesen ForeFlight extortion plot drew immediate attention due to his family ties. Evidence indicates that Khader’s father is employed by Royal Jordanian Airlines, a government-influenced carrier operating long-haul routes aboard Boeing aircraft. While Rey\u2019s early 2025 claims on Telegram that his father worked as an airline pilot could not be independently verified, digital forensics from previous security breaches told a clearer story. <\/p>\n

A password-stealing malware infection on the Khader family’s shared household computer revealed that Rey\u2019s father routinely utilized identical credentials across multiple administrative and employee portals for Royal Jordanian Airlines. Although neither Khader nor his father responded to multiple requests for comment, Rey abruptly began deleting his social media profiles\u2014including his primary Twitter\/X account used to mock federal law enforcement and rival hackers\u2014within hours of journalists reaching out to his family home.<\/p>\n

Despite scrubbing his social profiles, Rey\u2019s technical blog hosted on GitHub remained online. The public posts highlighted an ongoing obsession with the leadership of the Cl0p ransomware operation, culminating in a detailed investigative post published in March that attempted to dox two Russian nationals operating as the core developers behind Cl0p.<\/p>\n

Murder-for-Hire Allegations Surface in the Netherlands<\/h2>\n

While the investigation into the teenage Jordanian suspect progressed, legal proceedings in the Netherlands revealed explosive and shocking allegations concerning Pepijn van der Stap. Dutch daily newspaper RTL reported that investigators harbor strong suspicions that Van der Stap attempted to commission at least two murders to be carried out abroad.<\/p>\n

\"ShinyHunters<\/figure>\n

Van der Stap had previously served the majority of a four-year prison sentence for extensive data theft and extortion schemes that prosecutors estimated generated between 1.5 million and 2.7 million euros. Following his release, he successfully cultivated a public image as a reformed hacker, even securing employment as an "offensive security lead" at Neo Security, an Amsterdam-based cybersecurity firm. <\/p>\n

In an interview just days prior to his arrest, Van der Stap defended his rehabilitation and employment, maintaining that his professional contributions spoke for themselves despite the skepticism of his critics. However, those claims collapsed on the night of September 15 when heavily armed Dutch tactical units executed a dramatic raid on his residence, reportedly utilizing flash-bang grenades. <\/p>\n

Benjamin Korper, the owner of Neo Security, stated that he immediately hired external auditors to examine company systems following the raid. Thus far, investigators have uncovered no evidence that Van der Stap compromised his employer or its clientele. Prior to his initial 2023 conviction, Van der Stap had worked as a software engineer at a prominent local cybersecurity startup while volunteering with the Dutch Institute for Vulnerability Disclosure, operating a sophisticated cybercrime enterprise behind a veneer of legitimate industry participation.<\/p>\n

Franchising and Burning a Brand<\/h2>\n

Security experts emphasize that the individuals operating under the ShinyHunters banner today bear little resemblance to the original core members of the syndicate, most of whom are French nationals who have previously faced arrest and imprisonment for cybercrime. Instead, ShinyHunters has evolved into an informal franchise model\u2014operating much like the mythical "Dread Pirate Roberts" persona, where the brand persists through successive waves of arrests.<\/p>\n

Current law enforcement efforts focus on a decentralized network of freelance cybercriminals and affiliates who compromise software-as-a-service platforms, harvest enterprise credentials, and feed access to ransomware intermediaries in exchange for a percentage of any eventual extortion payouts.<\/p>\n

\"ShinyHunters<\/figure>\n

Following the arrest of Van der Stap and the subsequent sudden offline status of the ShinyHunters darknet portal, online criminal forums erupted in criticism directed at Rey. Commentators on specialized Telegram channels accused the teenager of purchasing legacy PGP keys and forum credentials to "larp" as ShinyHunters, effectively cheapening the brand’s reputation while generating millions of dollars in damages through independent extortion operations. <\/p>\n

A specialized monitoring channel dedicated to tracking the group asserted that Rey had partnered with several small cell networks over recent months, utilizing the ShinyHunters moniker to negotiate ransom settlements in exchange for a 25 to 30 percent cut of the proceeds.<\/p>\n

The escalating pressure from law enforcement follows a bizarre public relations war initiated by the hackers themselves. Earlier in the year, ShinyHunters took the extraordinary step of targeting federal infrastructure directly to counter an FBI advisory warning victims against paying ransoms. In interviews with security journalists, syndicate representatives admitted that their intrusion into FBI systems served primarily as a marketing campaign to discredit federal warnings and reassure prospective extortion targets of their technical capabilities. <\/p>\n

However, as international cooperation tightens and key affiliates like Rey and Van der Stap find themselves detained or facing severe criminal charges, the resilience of the franchise model faces its most significant threat to date.<\/p>\n","protected":false},"excerpt":{"rendered":"

A teenage cybercriminal from Amman, Jordan, suspected of orchestrating the operations of the prolific data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with federal investigators in the United States. According to security reporting and sources familiar with the ongoing multi-jurisdictional investigation, the suspect\u2014who operates online<\/p>\n","protected":false},"author":3,"featured_media":1193,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[142],"tags":[392,560,1035,1275,143,146,172,1101,144,173,226,337,169,1283,145],"class_list":["post-1194","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-news","tag-alleged","tag-amid","tag-cooperating","tag-crackdown","tag-cybersecurity","tag-defense","tag-detained","tag-escalating","tag-hacking","tag-jordan","tag-leader","tag-ransomware","tag-shinyhunters","tag-syndicate","tag-threats"],"_links":{"self":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/1194","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1194"}],"version-history":[{"count":0,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/1194\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/media\/1193"}],"wp:attachment":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1194"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1194"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1194"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}