{"id":988,"date":"2026-10-08T22:38:19","date_gmt":"2026-10-08T22:38:19","guid":{"rendered":"https:\/\/wyominginvest.com\/?p=988"},"modified":"2026-10-08T22:38:19","modified_gmt":"2026-10-08T22:38:19","slug":"key-shinyhunters-suspect-detained-in-jordan-and-cooperating-with-fbi-amid-high-profile-extortion-case","status":"publish","type":"post","link":"https:\/\/wyominginvest.com\/?p=988","title":{"rendered":"Key ShinyHunters Suspect Detained in Jordan and Cooperating With FBI Amid High-Profile Extortion Case"},"content":{"rendered":"

A teenager from Amman, Jordan, suspected of operating as a key leader within the prolific and destructive data theft and extortion collective known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the Federal Bureau of Investigation (FBI) to unmask other members of the hacking syndicate. <\/p>\n

According to investigative findings by KrebsOnSecurity, the suspect\u2014who operates online under the hacker handle "Rey"\u2014was taken into custody just as ShinyHunters was actively attempting to extort a vital business unit recently divested by global aerospace giant Boeing. In a striking coincidence that underscores the tangled personal and professional webs often found in modern cybercrime investigations, the target of the extortion was a subsidiary of the very company that manufactures the aircraft fleet flown by the employer of Rey\u2019s father: Royal Jordanian Airlines.<\/p>\n

International Detentions and High-Stakes Extortion<\/h3>\n

The operation against the young suspect, identified by international media and security researchers as Saif Al-din Khader, came to light when Reuters cited three unnamed sources confirming that Jordanian authorities had detained a local individual linked to ShinyHunters who was actively aiding the FBI. KrebsOnSecurity had previously identified Rey as Khader in a detailed November 2025 investigative profile, wherein the young man openly admitted to maintaining operational ties with multiple ransomware and extortion groups.<\/p>\n

Khader’s detention follows closely on the heels of another major international law enforcement action. On September 28, reports detailed the arrest of 24-year-old Dutch cybercriminal Pepijn van der Stap by Dutch police on suspicion of facilitating data thefts and extortion campaigns for ShinyHunters. According to investigators, immediately following Van der Stap\u2019s dramatic evening arrest on September 15, Rey stepped into the vacuum, aggressively assuming control of the ShinyHunters brand online. Seizing the banner of the notorious hacking collective, Rey publicly boasted about successfully breaching sensitive infrastructure belonging to the FBI and launching extortion attacks against the rival ransomware operation known as Cl0p.<\/p>\n

In a brazen display of digital bravado, Rey utilized his long-standing Twitter\/X account to taunt both federal law enforcement and the Cl0p ransomware syndicate. He shared a series of custom memes, strategically embedding images of the avatar previously used by Van der Stap under his former hacker alias, "Umbreon." Cybersecurity experts noted that this digital posturing was an apparent and deliberate attempt by Rey to frame the newly arrested Dutchman for the fresh wave of high-profile cyberattacks.<\/p>\n

\"ShinyHunters<\/figure>\n

The technological vector behind these breaches traced back to a critical vulnerability tracked as CVE-2026-35273. The flaw targeted PeopleSoft, a widely deployed software-as-a-service platform owned by technology conglomerate Oracle that corporations and government agencies heavily rely upon for managing human resources, payroll, recruitment, and employee benefits. Although Oracle rapidly pushed out a security update after ShinyHunters began exploiting the vulnerability as a zero-day in June, and Mandiant subsequently issued defensive web application firewall (WAF) rules, the threat actors demonstrated persistent adaptability. After initial attempts to directly breach the FBI’s internal PeopleSoft database proved unsuccessful, ShinyHunters later utilized a well-known URL-encoding bypass trick to circumvent Mandiant\u2019s defensive safeguards.<\/p>\n

In a joint threat intelligence report released on September 25, security analysts from Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters had leveraged the PeopleSoft vulnerability in a mass-exploitation campaign. The attacks successfully compromised systems across an array of vital sectors, including higher education, healthcare, technology, agriculture, transportation, and government agencies. Further compounding the fallout, Reuters reported that the FBI was forced to remove an Accenture contractor following a damaging data breach of the bureau’s recruitment website. That incident exposed sensitive personal and professional details for more than 5,000 FBI personnel, including specialized unit assignments, psychiatric records, and medical files.<\/p>\n

‘Rey’ Means King, as in Royal<\/h3>\n

Investigators familiar with the ongoing ShinyHunters case revealed that the pressure on the hacking collective intensified dramatically when they targeted a digital aviation and navigation unit divested by Boeing. The attempted extortion of this former Boeing subsidiary involved the theft of sensitive data that sources warned could pose genuine operational safety and security risks.<\/p>\n

In a brief statement addressing the incident, Boeing acknowledged the extortion claims made by the threat actors. The company clarified that the compromised data originated from Jeppesen ForeFlight, a specialized navigation and flight planning subsidiary that Boeing sold in November 2025 to private equity firm Thoma Bravo in a transaction valued at $10.55 billion. Representatives for Jeppesen ForeFlight maintained that an internal investigation revealed no operational or product disruptions stemming from the incident, crediting the company’s proactive security posture.<\/p>\n

The involvement of Khader in the Jeppesen ForeFlight extortion attempt carries unique geopolitical and familial context. Credible evidence indicates that Khader’s father is employed by Royal Jordanian Airlines, a carrier majority-controlled by the Jordanian government that operates its long-haul passenger fleet using Boeing aircraft. While Khader had boasted on Telegram in early 2025 that his father worked as an airline pilot\u2014a claim that could not be independently verified\u2014digital forensics from a password-stealing malware infection on the family\u2019s shared home computer revealed a damning overlap. Forensic artifacts demonstrated that Khader’s father had repeatedly used identical login credentials across various online employee portals for Royal Jordanian Airlines.<\/p>\n

\"ShinyHunters<\/figure>\n

Despite inquiries from journalists, neither Royal Jordanian Airlines nor the Khader family offered public comments on the matter. However, shortly after receiving inquiries regarding his son’s digital activities, Rey systematically began scrubbing his digital footprint, deleting numerous social media accounts, including the Twitter\/X profile he had used to taunt law enforcement and corporate victims. <\/p>\n

One digital asset that managed to survive the purge was Rey’s cybersecurity blog hosted on GitHub. The repository revealed a distinct fixation on the leadership of the Cl0p ransomware group. In March 2026, Rey published a comprehensive investigative blog post that successfully doxxed two Russian men alleged to be the core software developers and operational masterminds behind Cl0p, one of the longest-running extortion rings in the cybercrime ecosystem.<\/p>\n

Murder-for-Hire Allegations in the Netherlands<\/h3>\n

While the investigation into Khader unfolded in the Middle East, legal proceedings in Europe brought shocking new allegations to light regarding Pepijn van der Stap. Dutch media outlet RTL reported that local prosecutors and investigators suspect Van der Stap attempted to orchestrate at least two murders abroad. The explosive claims starkly contrasted with the public narrative of personal rehabilitation and transformation that Van der Stap had cultivated following his release from a nearly four-year prison sentence for prior data theft and extortion convictions, which prosecutors estimated netted between 1.5 million and 2.7 million euros.<\/p>\n

Prior to his September 15 arrest\u2014which involved a dramatic police raid utilizing flash-bang grenades by specialized tactical units in Amsterdam\u2014Van der Stap had successfully convinced industry peers, journalists, and former colleagues that he had turned his life around. At the time of his apprehension, he was employed as an "offensive security lead" at a Dutch cybersecurity firm named Neo Security, where his responsibilities ostensibly included testing client defenses. Benjamin Korper, the owner of Neo Security, confirmed that an independent firm was brought in to audit the company’s networks for any internal compromise, though initial reviews found no evidence that Van der Stap had acted against his employer or its clients.<\/p>\n

Before his initial 2023 conviction, Van der Stap maintained a dual life, working as a software engineer for an Amsterdam-based cybersecurity startup while volunteering for the Dutch Institute for Vulnerability Disclosure (DIVD), all while secretly hacking and extorting major multinational organizations. When questioned by security journalists shortly before his second arrest about why anyone should trust a self-described reformed hacker, Van der Stap maintained that his actions and security work would ultimately speak for themselves, conceding that skeptics would remain unconvinced regardless of his statements.<\/p>\n

\"ShinyHunters<\/figure>\n

Franchising and Burning a Brand<\/h3>\n

Security researchers emphasize that the individuals operating under the ShinyHunters moniker today do not represent the original core members of the group, most of whom are French citizens who have faced arrest and prosecution for historic cybercrime operations. Instead, ShinyHunters has evolved into a fractured franchise model. <\/p>\n

Comparing the group’s operational structure to the fictional character "The Dread Pirate Roberts" from the classic film The Princess Bride<\/em>, threat intelligence experts noted that leadership succession within the brand occurs not through death, but through arrest\u2014frequently resulting in multiple individuals claiming the banner simultaneously. The FBI has increasingly focused its investigative efforts on a network of freelance cybercriminals and affiliates who supply stolen corporate software credentials to the collective in exchange for a percentage of subsequent ransom payments.<\/p>\n

In the wake of Van der Stap\u2019s arrest and the subsequent takedown of the group’s darknet portal following an FBI ultimatum, Rey\u2019s private Telegram chat channels erupted in internal criticism. Rival cybercriminals and forum participants openly mocked the young hacker, accusing him of purchasing legacy PGP keys and forum databases merely to larp as ShinyHunters, ransom vulnerable companies, and resell stolen data for personal profit. <\/p>\n

A dedicated Telegram monitoring channel known as "The Battle" relentlessly doxxed and criticized Khader and his associates, characterizing the teenager as an inexperienced greenhorn attempting to exploit the notoriety of a severely compromised brand. According to administrators of the monitoring channel, Khader allegedly managed multiple affiliate groups over preceding months, leveraging the ShinyHunters alias to negotiate extortion settlements in exchange for a cut ranging from 25 to 30 percent, generating millions in cumulative damages.<\/p>\n

The public exposure and operational friction prompted rare public communications from the hacking collective. In an interview with industry publication The Register<\/em>, representatives for ShinyHunters claimed that their digital incursions against federal law enforcement were executed specifically to counter the narrative pushed by an FBI flash notice issued in May 2026. That advisory warned victim organizations against yielding to extortion demands and detailed the group’s aggressive harassment tactics, which have historically included direct phone calls, threatening text messages, swatting incidents, and false claims regarding the possession of sensitive personal media.<\/p>\n

\"ShinyHunters<\/figure>\n

While the hackers asserted that their breach of federal infrastructure was designed to demonstrate technical proficiency and push back against public warnings, group representatives acknowledged the commercial reality of law enforcement advisories. They conceded that the FBI’s public interventions severely disrupted their leverage and undermined their core business model of convincing victim corporations to pay multimillion-dollar ransoms.<\/p>\n","protected":false},"excerpt":{"rendered":"

A teenager from Amman, Jordan, suspected of operating as a key leader within the prolific and destructive data theft and extortion collective known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the Federal Bureau of Investigation (FBI) to unmask other members of the hacking syndicate. According to investigative findings by<\/p>\n","protected":false},"author":5,"featured_media":987,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[198],"tags":[560,1142,1035,146,172,837,83,173,184,1059,205,169,204,170],"class_list":["post-988","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-phishing-social-engineering","tag-amid","tag-case","tag-cooperating","tag-defense","tag-detained","tag-extortion","tag-high","tag-jordan","tag-phishing","tag-profile","tag-security-awareness","tag-shinyhunters","tag-social-engineering","tag-suspect"],"_links":{"self":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/988","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=988"}],"version-history":[{"count":0,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/988\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/media\/987"}],"wp:attachment":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=988"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=988"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=988"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}