{"id":1398,"date":"2026-10-12T14:51:25","date_gmt":"2026-10-12T14:51:25","guid":{"rendered":"https:\/\/wyominginvest.com\/?p=1398"},"modified":"2026-10-12T14:51:25","modified_gmt":"2026-10-12T14:51:25","slug":"jordanian-teenager-suspected-of-leading-shinyhunters-detained-and-cooperating-with-fbi","status":"publish","type":"post","link":"https:\/\/wyominginvest.com\/?p=1398","title":{"rendered":"Jordanian Teenager Suspected of Leading ShinyHunters Detained and Cooperating With FBI"},"content":{"rendered":"

A teenage hacker from Amman, Jordan, suspected of acting as a principal leader of the prolific data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the FBI to help unmask and identify other members of the notorious cybercriminal gang. <\/p>\n

According to investigative reporting by KrebsOnSecurity and initial disclosures by Reuters, the suspect\u2014who operates online under the hacker handle "Rey"\u2014was apprehended just as ShinyHunters was in the middle of executing a high-stakes extortion campaign against a business unit recently divested by global aerospace giant Boeing. In a striking twist of geographical coincidence, the suspect’s father is employed by Royal Jordanian Airlines, an enterprise that relies heavily on a fleet of commercial passenger aircraft manufactured by Boeing.<\/p>\n

The Rise and Fall of "Rey"<\/h3>\n

The detained individual has been identified in reports as Saif Al-din Khader. KrebsOnSecurity first brought Khader into public focus in a November 2025 investigative profile, which documented his admissions of working alongside multiple ransomware syndicates and managing prominent cybercriminal communities. <\/p>\n

Khader\u2019s digital footprint surfaced once again in late September during coverage of a coordinated international law enforcement sweep. Dutch police arrested 24-year-old convicted cybercriminal Pepijn van der Stap, known previously by the hacker alias "Umbreon," on suspicion of providing material aid to ShinyHunters’ data theft and extortion operations. Investigators noted that immediately following Van der Stap’s arrest on the evening of September 15, Khader brazenly assumed operational control over the ShinyHunters brand. <\/p>\n

\"ShinyHunters<\/figure>\n

Leveraging his newly acquired influence, Khader took to social media to publicly boast about breaching highly sensitive networks, including systems belonging to the FBI, while attempting to extort the rival Cl0p ransomware organization. He disseminated a series of mocking memes targeting both federal law enforcement and the Cl0p syndicate from his established account on Twitter\/X. In an apparent effort to deflect suspicion and frame his arrested peer, Khader\u2019s posts prominently featured avatars and graphical elements associated with Van der Stap\u2019s former "Umbreon" persona.<\/p>\n

Exploiting Oracle PeopleSoft<\/h3>\n

The broader crime wave orchestrated by the renewed ShinyHunters faction relied heavily on the mass exploitation of enterprise software vulnerabilities. The group gained unauthorized access to the FBI recruitment portal and dozens of corporate networks by leveraging a critical security flaw, tracked as CVE-2026-35273, affecting Oracle PeopleSoft. The software-as-a-service platform is widely utilized across various industry sectors for managing human resources, payroll, benefits, and internal hiring processes.<\/p>\n

Oracle moved swiftly to issue patches after ShinyHunters began weaponizing the vulnerability as a zero-day exploit in June. Concurrently, cybersecurity firm Mandiant released specialized web application firewall (WAF) rules designed to protect organizations that could not immediately apply the software updates. Despite these defensive measures, security analysts at Mandiant and the Google Threat Intelligence Group (GTIG) confirmed in a late September joint report that the hackers successfully bypassed initial mitigations by employing well-known URL-encoding tricks. <\/p>\n

The campaign’s impact proved severe. Investigative reports revealed that the FBI was forced to remove an Accenture contractor following a damaging data breach on the bureau’s recruitment website. The intrusion exposed sensitive background information concerning more than 5,000 FBI personnel, detailing individual specializations, unit assignments, and confidential medical and psychiatric records.<\/p>\n

\"ShinyHunters<\/figure>\n

"Rey" Means King, as in Royal<\/h3>\n

Law enforcement sources familiar with the ongoing international investigation indicated that the FBI’s pursuit of ShinyHunters gained critical momentum when the group targeted the digital aviation and navigation unit divested by Boeing. The attempted extortion involved proprietary and sensitive data that investigators feared could introduce substantial operational safety and security vulnerabilities.<\/p>\n

Boeing formally acknowledged the extortion attempts in a statement, confirming that the threat actors claimed possession of data originating from Jeppesen ForeFlight, a navigation subsidiary that Boeing sold to private equity firm Thoma Bravo for $10.55 billion. Representatives for Jeppesen ForeFlight stated that internal investigations and proactive security postures ensured zero impact on ongoing operations or commercial products.<\/p>\n

Khader’s alleged involvement in the Jeppesen ForeFlight extortion plot drew intense scrutiny due to his familial ties to Royal Jordanian Airlines. While Khader claimed on Telegram channels that his father worked as an airline pilot, cybersecurity analyses of malware infections on the family’s shared computer revealed a more direct digital connection. Password-stealing malware logs demonstrated that Khader’s father used identical credentials to access multiple employee portals administered by the airline.<\/p>\n

Following inquiries directed at his family, Khader began rapidly scrubbing his digital footprint, purging various social media profiles and silencing the accounts previously used to taunt federal investigators. However, a public cybersecurity blog maintained by Khader on GitHub remained active, featuring a detailed investigative post published in March that doxed two Russian nationals accused of operating the core infrastructure behind the Cl0p ransomware group.<\/p>\n

\"ShinyHunters<\/figure>\n

Murder-For-Hire Allegations in the Netherlands<\/h3>\n

While authorities in the Middle East focused on Khader, Dutch media outlets revealed shocking developments regarding the arrest of Pepijn van der Stap. Dutch daily newspaper RTL reported that investigators suspect Van der Stap of orchestrating at least two contract murders to be carried out abroad. <\/p>\n

Van der Stap had previously served the majority of a four-year prison sentence for extensive data theft and extortion schemes that prosecutors estimated generated between \u20ac1.5 million and \u20ac2.7 million in illicit proceeds. Following his release, Van der Stap successfully projected an image of personal rehabilitation, securing employment as an "offensive security lead" at Neo Security, a Dutch cybersecurity firm where he purportedly tested client network defenses.<\/p>\n

Neo Security\u2019s owner, Benjamin Korper, told reporters that the firm retained external auditors to investigate whether Van der Stap compromised internal networks or client data, though initial reviews found no evidence of malicious activity directed against the employer. Dutch forensic teams ultimately apprehended Van der Stap during a dramatic nighttime police raid in Amsterdam that reportedly involved the use of flash-bang grenades.<\/p>\n

Franchising and Burning a Brand<\/h3>\n

Cybersecurity experts emphasize that the individuals operating under the modern ShinyHunters banner bear little relation to the original core members of the group, most of whom are French nationals previously apprehended by European law enforcement. Instead, the syndicate has evolved into a franchise model comparable to the fictional "Dread Pirate Roberts," where successful arrest cycles prompt succession by freelance affiliates.<\/p>\n

\"ShinyHunters<\/figure>\n

Investigators note that these modern affiliates operate largely by feeding stolen software-as-a-service credentials to decentralized chat groups in exchange for a percentage of subsequent ransom payments. Within specialized cybercrime forums on Telegram, community members heavily criticized Khader for cheapening the group’s reputation. Commentators accused the teenager of purchasing legacy PGP keys and forum credentials to impersonate the brand, artificially inflating his status before federal pressure forced his detention and the subsequent offline status of the group’s darknet infrastructure.<\/p>\n

The decentralized friction culminated in public expos\u00e9s published by rival underground channels, which detailed Khader’s operational methods and minor role among international cybercriminal cells. Despite the public posturing and attempts by the hackers to frame their attacks on federal agencies as public relations victories, international law enforcement cooperation continues to dismantle the remaining digital infrastructure supporting the franchise.<\/p>\n","protected":false},"excerpt":{"rendered":"

A teenage hacker from Amman, Jordan, suspected of acting as a principal leader of the prolific data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the FBI to help unmask and identify other members of the notorious cybercriminal gang. According to investigative reporting by KrebsOnSecurity<\/p>\n","protected":false},"author":11,"featured_media":1397,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[142],"tags":[1035,143,146,172,144,1412,1415,169,1414,1413,145],"class_list":["post-1398","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-news","tag-cooperating","tag-cybersecurity","tag-defense","tag-detained","tag-hacking","tag-jordanian","tag-leading","tag-shinyhunters","tag-suspected","tag-teenager","tag-threats"],"_links":{"self":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/1398","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1398"}],"version-history":[{"count":0,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/1398\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/media\/1397"}],"wp:attachment":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1398"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1398"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1398"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}