{"id":1228,"date":"2026-10-10T22:51:32","date_gmt":"2026-10-10T22:51:32","guid":{"rendered":"https:\/\/wyominginvest.com\/?p=1228"},"modified":"2026-10-10T22:51:32","modified_gmt":"2026-10-10T22:51:32","slug":"alleged-teenage-leader-of-shinyhunters-detained-in-jordan-and-cooperating-with-fbi-amid-escalating-global-cybercrime-sweep","status":"publish","type":"post","link":"https:\/\/wyominginvest.com\/?p=1228","title":{"rendered":"Alleged Teenage Leader of ShinyHunters Detained in Jordan and Cooperating With FBI Amid Escalating Global Cybercrime Sweep"},"content":{"rendered":"

A teenager residing in Amman, Jordan, who is suspected of acting as a principal leader of the prolific data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the Federal Bureau of Investigation (FBI) to identify other members of the hacking collective. <\/p>\n

According to investigative reporting by KrebsOnSecurity, the suspect\u2014who operates online under the hacker handle "Rey"\u2014was apprehended at a critical juncture. The arrest coincided with a period when ShinyHunters was actively attempting to extort a business unit recently divested by global aerospace giant Boeing. In a striking twist of geographical and professional irony, the target of the extortion shares an indirect connection to the employer of Rey\u2019s father, who works for Royal Jordanian Airlines\u2014an organization that operates its long-haul fleet using passenger aircraft manufactured by Boeing.<\/p>\n

The unfolding developments follow a series of reports from major international news outlets and cybersecurity researchers detailing the rapid unravelling of the current iteration of ShinyHunters. On October 3, Reuters cited three unnamed sources confirming that a suspected ShinyHunters member in Amman named Saif Al-din Khader had been detained by Jordanian authorities and was actively assisting the FBI. This revelation corroborated a November 2025 investigative profile by KrebsOnSecurity, which first identified Rey as Khader and noted the young man’s admissions regarding his collaborations with multiple ransomware syndicates.<\/p>\n

Rey\u2019s name surfaced once again in late September during an exclusive report regarding the arrest of 24-year-old Dutch cybercriminal Pepijn van der Stap. Dutch police apprehended Van der Stap on suspicion of facilitating data thefts and extortion schemes on behalf of ShinyHunters. Security analysts noted that immediately following the dramatic Dutch police raid on the evening of September 15, Rey seized control of the ShinyHunters brand, publicly boasting about data he claimed to have stolen from the FBI and detailing extortion attempts directed against the prominent ransomware group Cl0p.<\/p>\n

In an apparent attempt to misdirect investigators and frame the newly arrested Dutchman, Rey taunted both federal law enforcement and the Cl0p syndicate by publishing a series of memes on his long-standing Twitter\/X account. These posts prominently featured the avatar used by Van der Stap during his former tenure under the hacker alias "Umbreon."<\/p>\n

\"ShinyHunters<\/figure>\n

Despite these elaborate digital deceptions, the underlying infrastructure exploited by the group quickly became the focal point of a massive international law enforcement response. As detailed in security advisories, ShinyHunters managed to breach the FBI\u2019s recruitment portal and various other corporate systems by exploiting a critical zero-day vulnerability, cataloged as CVE-2026-35273, affecting Oracle\u2019s PeopleSoft platform. The software-as-a-service (SaaS) tool is widely utilized across enterprise environments to manage human resources, payroll, benefits, and hiring pipelines.<\/p>\n

Oracle moved swiftly to issue a security patch after ShinyHunters began weaponizing the vulnerability in June. Simultaneously, cybersecurity firm Mandiant released specialized web application firewall (WAF) rules to protect organizations unable to immediately apply the vendor update. Although the group initially boasted to industry media that their primary objective was to breach the FBI’s internal PeopleSoft database\u2014an attempt they admitted was ultimately unsuccessful\u2014they later bypassed Mandiant’s defensive measures by employing a well-known URL-encoding trick.<\/p>\n

A comprehensive threat intelligence report released jointly by Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters executed a mass-exploitation campaign targeting the PeopleSoft vulnerability. The attacks compromised data across dozens of organizations spanning diverse economic sectors, including higher education, technology, healthcare, agriculture, transportation, and government entities. Subsequent reports revealed that the FBI was forced to remove an Accenture contractor following a damaging data breach on the agency’s recruitment website, which exposed sensitive personal and professional details\u2014including unit assignments, specializations, and medical records\u2014pertaining to more than 5,000 FBI personnel.<\/p>\n

"Rey" Means King, as in Royal<\/h2>\n

As the investigation intensified, sources close to the case revealed that a navigation and digital aviation unit recently divested by Boeing was among the primary targets undergoing active extortion when Rey was taken into custody by Jordanian authorities. The inclusion of a Boeing-linked division introduced severe national security and operational safety concerns, injecting a renewed sense of urgency into the FBI’s pursuit of the group.<\/p>\n

Boeing formally acknowledged the extortion attempts in a statement, clarifying that the targeted data originated from Jeppesen ForeFlight, a specialized subsidiary that Boeing sold to private equity firm Thoma Bravo for $10.55 billion in November 2025. <\/p>\n

\"ShinyHunters<\/figure>\n

"We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight," a Boeing spokesperson stated, adding that the company has been actively reviewing the situation alongside the subsidiary’s team. Representatives for Jeppesen ForeFlight maintained that their internal investigations revealed no operational disruptions or product impacts resulting from the claims.<\/p>\n

Rey\u2019s alleged role in targeting the aviation unit drew intense scrutiny due to evidence connecting his family to Royal Jordanian Airlines, a carrier predominantly controlled by the Jordanian government that relies heavily on Boeing aircraft. Although early 2025 Telegram posts in which Rey claimed his father was an airline pilot could not be independently verified, a previous forensic review of the family’s shared home computer revealed password-stealing malware artifacts. The compromised data demonstrated that Rey’s father utilized identical credentials across multiple administrative portals operated by Royal Jordanian Airlines.<\/p>\n

While Royal Jordanian Airlines declined to comment, inquiries sent to Rey’s father by investigative journalists immediately preceded a digital purge by the young hacker. Just hours after receiving the media outreach, Rey began systematically deleting his social media profiles, including the Twitter\/X account used to mock federal investigators and ransomware syndicates.<\/p>\n

Despite scrubbing his social media presence, Rey left behind a cybersecurity blog hosted on GitHub that offered a glimpse into his ongoing obsessions. A lengthy post published on the blog in March 2026 detailed an independent investigation that successfully doxxed two Russian men alleged to be the core developers and operators behind Cl0p, one of the oldest and most entrenched ransomware operations still active.<\/p>\n

Murder-for-Hire Allegations Surface in the Netherlands<\/h2>\n

While the investigation into the teenage administrator progressed in the Middle East, legal proceedings in the Netherlands revealed staggering new accusations against Pepijn van der Stap. Despite widespread public media coverage highlighting his supposed personal and professional rehabilitation following a prior conviction, Dutch daily newspaper RTL reported that investigators suspect Van der Stap attempted to orchestrate at least two murders abroad.<\/p>\n

\"ShinyHunters<\/figure>\n

Van der Stap had recently completed the majority of a four-year prison sentence for extensive data theft and extortion activities that prosecutors estimated yielded between 1.5 million and 2.7 million euros. Prior to his September arrest, he had secured a position as an "offensive security lead" at a Dutch cybersecurity firm named Neo Security, where he claimed his responsibilities involved authorized penetration testing for corporate clients.<\/p>\n

Neo Security\u2019s owner, Benjamin Korper, informed reporters that an independent firm had been retained to audit the company’s systems for any signs of internal compromise by Van der Stap. Thus far, investigators have found no evidence that the suspect targeted his employer or its clientele. However, the operational reality of the arrest was underscored by local reports detailing a dramatic police raid on Van der Stap’s residence utilizing flash-bang grenades.<\/p>\n

Before his initial legal troubles in 2023, Van der Stap maintained a dual existence as a software engineer for an Amsterdam-based cybersecurity startup and a volunteer for the Dutch Institute for Vulnerability Disclosure (DIVD), even as he covertly breached and extorted major international enterprises. When questioned regarding the credibility of his claims of reform, Van der Stap maintained that his actions and ongoing efforts to assist victims were the only metrics by which he could be judged.<\/p>\n

Franchising and Burning a Brand<\/h2>\n

Cybersecurity experts emphasize that the individuals currently operating under the ShinyHunters banner do not represent the original core members of the group, most of whom are French nationals previously apprehended or imprisoned for cybercrime offenses. Instead, ShinyHunters has evolved into a decentralized franchise model. <\/p>\n

Investigators liken the modern structure to the fictional literary concept of the Dread Pirate Roberts, where succession occurs not through death, but through arrest, often resulting in multiple individuals operating under the same pseudonym simultaneously. Law enforcement focus has increasingly shifted toward a network of freelance cybercriminals and affiliates who supply stolen credentials for corporate SaaS platforms in exchange for a percentage of the subsequent ransoms extracted from victims.<\/p>\n

\"ShinyHunters<\/figure>\n

Following the news of Van der Stap’s arrest, private cybercrime communication channels on Telegram erupted with criticism directed at Rey. Commentators accused the teenager of purchasing legacy PGP keys and forum credentials to resurrect defunct branding, utilizing stolen aliases to execute unsophisticated extortion schemes and alienate the broader cybercrime underground. A dedicated monitoring channel known as "The Battle" aggressively doxxed and ridiculed Rey and his associates, characterizing him as an inexperienced novice who sought to exploit a notorious brand name.<\/p>\n

According to administrative notes published on the channel, Rey was believed to have generated substantial financial damages while operating alongside several decentralized affiliate groups, negotiating corporate ransoms in exchange for a substantial cut of the proceeds. <\/p>\n

The group’s operational motivations were further highlighted in interviews with specialized technology publications, where representatives of ShinyHunters claimed their decision to target federal law enforcement was designed to counter official advisories warning victims against yielding to extortion demands. The FBI\u2019s May 2026 flash notice had explicitly cautioned organizations against paying ransoms, noting that the collective frequently employed aggressive harassment tactics\u2014including threatening phone calls, text messages, and swatting incidents\u2014while making false claims regarding the possession of compromising media.<\/p>\n

While the hackers asserted that their high-profile incursions served as a technical demonstration and a public relations countermeasure against official guidance, the ensuing crackdown by international law enforcement agencies has systematically dismantled the digital infrastructure, communication channels, and leadership hierarchy underpinning the modern ShinyHunters network.<\/p>\n","protected":false},"excerpt":{"rendered":"

A teenager residing in Amman, Jordan, who is suspected of acting as a principal leader of the prolific data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the Federal Bureau of Investigation (FBI) to identify other members of the hacking collective. According to investigative reporting<\/p>\n","protected":false},"author":14,"featured_media":1227,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[142],"tags":[392,560,1035,1300,143,146,172,1101,906,144,173,226,169,1301,1299,145],"class_list":["post-1228","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-news","tag-alleged","tag-amid","tag-cooperating","tag-cybercrime","tag-cybersecurity","tag-defense","tag-detained","tag-escalating","tag-global","tag-hacking","tag-jordan","tag-leader","tag-shinyhunters","tag-sweep","tag-teenage","tag-threats"],"_links":{"self":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/1228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1228"}],"version-history":[{"count":0,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/1228\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/media\/1227"}],"wp:attachment":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}