A teenager residing in Amman, Jordan, who is suspected of acting as the mastermind behind the prolific and aggressive data theft syndicate known as "ShinyHunters," has been detained by local authorities. According to reports, the suspect—who operates under the hacker handle "Rey"—is currently cooperating with the Federal Bureau of Investigation (FBI) in an effort to identify and dismantle the broader infrastructure of the hacking collective.
The detention of the suspect, identified by KrebsOnSecurity and Reuters as Saif Al-din Khader, marks a significant turning point in the long-running investigation into the group. Khader’s apprehension occurred while ShinyHunters was in the midst of an active extortion campaign targeting a business unit recently divested by the global aerospace giant Boeing. The irony of the target is particularly striking: the business unit in question, Jeppesen ForeFlight, manufactures software for the fleet of aircraft operated by the employer of Khader’s father, Royal Jordanian Airlines.
The Rise and Fall of "Rey"
The identification of Khader as the primary administrator behind the ShinyHunters persona follows a November 2025 profile by KrebsOnSecurity, in which the young man openly admitted to collaborating with various ransomware groups. His activities had escalated significantly in recent months, culminating in a series of brazen attacks that drew the direct ire of federal law enforcement.
The investigation gained momentum following the September 28 arrest of 24-year-old Dutch national Pepijn van der Stap. Dutch police took the convicted cybercriminal into custody on suspicion of providing material support to ShinyHunters’ data theft and extortion operations. Investigators noted that in the immediate aftermath of Van der Stap’s arrest on September 15, Khader—or "Rey"—took full control of the ShinyHunters brand. In a display of typical cyber-criminal bravado, he publicly boasted about compromising highly sensitive FBI data and attempted to extort the notorious Cl0p ransomware gang.
In an attempt to misdirect investigators and frame his former associate, Khader utilized his Twitter/X account to post taunting memes directed at both the FBI and Cl0p. These posts featured the avatar of "Umbreon," the alias previously used by Van der Stap, in a clumsy effort to cast suspicion on the Dutchman for the recent hacks.
Exploiting the Oracle PeopleSoft Vulnerability
The technical foundation of ShinyHunters’ recent surge in activity was the exploitation of a critical vulnerability (CVE-2026-35273) within PeopleSoft, a widely deployed software-as-a-service platform from Oracle used by organizations for payroll, HR, and benefits management. The group began utilizing this vulnerability as a zero-day exploit as early as June 2026.
Despite rapid intervention from Oracle and the release of web application firewall (WAF) rules by security firm Mandiant to mitigate the risk for organizations unable to patch immediately, the group proved resilient. ShinyHunters eventually bypassed these security measures by employing a well-known URL-encoding trick. Security researchers at Mandiant and the Google Threat Intelligence Group (GTIG) confirmed in a September 25 report that the group had used this vulnerability to infiltrate dozens of systems across diverse sectors, including government, healthcare, transportation, and higher education.
The fallout from these breaches has been severe. Reuters reported on October 5 that the FBI had terminated a contractor at Accenture due to a failure to patch the agency’s recruitment portal. This oversight allowed the hackers to exfiltrate sensitive records belonging to more than 5,000 FBI personnel, including private medical and psychiatric documentation, as well as specific details regarding the staff’s units and areas of professional specialization.
Extortion and the Boeing Connection
The scope of Khader’s ambitions extended to high-stakes corporate targets, specifically the aviation sector. Sources familiar with the investigation confirmed that at the time of his arrest, Khader was actively extorting Jeppesen ForeFlight, a digital aviation and navigation unit previously owned by Boeing. The FBI reportedly viewed the potential theft of this data with extreme urgency, as the information contained proprietary details that could have implications for operational safety and security within the aerospace industry.
Boeing acknowledged the extortion attempts, noting that the data in question originated from Jeppesen ForeFlight, which the company sold to the private equity firm Thoma Bravo for $10.55 billion in November 2025. "We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight," a Boeing spokesperson stated. "We are actively reviewing the matter with the Jeppesen ForeFlight team." Jeppesen ForeFlight, for its part, maintained that their internal investigation found no evidence of operational impact.
The personal connection to the aviation industry is impossible to ignore. Evidence suggests that Khader’s father is employed by Royal Jordanian Airlines, a carrier largely controlled by the Jordanian government that relies on Boeing aircraft for its international operations. Digital forensic analysis from a prior compromise of the family’s shared computer showed that Khader’s father frequently used the same login credentials across multiple employee portals for the airline. While neither Khader nor his father responded to requests for comment, the younger Khader began systematically deleting his social media accounts shortly after being contacted by journalists regarding his activities.
Allegations of Murder-for-Hire
The narrative surrounding the Dutch suspect, Pepijn van der Stap, has taken an even darker turn. While he had previously attempted to rebrand himself in the tech community as a "reformed" hacker and had even secured a position as an "offensive security lead" at a Dutch cybersecurity firm named Neo Security, local news reports from the Netherlands allege that Van der Stap is suspected of orchestrating at least two murders.
Dutch daily RTL reported on September 29 that investigators believe Van der Stap gave orders for these killings to be carried out abroad. The revelation has cast further doubt on his claims of rehabilitation. Before his September 15 arrest—a dramatic event involving the use of flash-bang grenades—Van der Stap had insisted to journalists that his work at Neo Security was a genuine attempt to contribute to the cybersecurity field. "You can throw a bunch of nice words at someone, but you can’t convince them if they don’t want to be convinced," he told KrebsOnSecurity on September 9. "I’m doing what I can to repay victims, and that’s all I can do."
The "Franchise" Model of Cybercrime
Security experts emphasize that the current iteration of ShinyHunters bears little resemblance to the original group, which was primarily composed of French nationals who have since been apprehended or incarcerated. Instead, the name has become a "franchise," similar to the concept of the Dread Pirate Roberts from the film The Princess Bride. In this model, the brand is passed down or shared among various freelance cybercriminals who use it as a banner under which to operate.
These affiliates often feed stolen credentials to SaaS platforms in exchange for a percentage of the ransom collected from victim organizations. This structure has made the group particularly difficult to track, as there is no single "head" of the operation.
The internal dynamics of these groups are often as chaotic as the attacks themselves. Following the news of Van der Stap’s arrest and the subsequent shutdown of the ShinyHunters darknet site, various cybercriminal chat channels on Telegram erupted in ridicule directed at Khader. Many participants mocked him for what they perceived as his amateurish handling of the brand and his decision to back down from threats against the FBI.
One prominent Telegram channel, "The Battle," which has been actively documenting and mocking the activities of various hackers, characterized Khader as a "clueless greenhorn." The administrators of the channel wrote, "Rey (Saif Al-Din Khader) made a serious mistake when he started pretending to be a member of ShinyHunters. That group had already been dismantled… yet Rey still chose to use its name while carrying out his crimes."
The group’s own public statements have been equally contradictory. In an interview with The Register, ShinyHunters claimed their attack on the FBI was a strategic move to refute official agency narratives, specifically the FBI’s May 2026 alert that advised victims against paying ransoms. The hackers admitted that the FBI’s warnings had significantly hampered their business model, describing their attacks as a "public relations and marketing initiative."
The FBI, however, has maintained a firm stance against the group, noting that ShinyHunters frequently employs harassment tactics, including threatening phone calls to victims and their families, as well as "swatting" incidents. The agency also warned that the group often makes false claims about possessing compromising photographs or videos of victims—content that, in many cases, does not exist at all. With Khader now in custody and reportedly assisting authorities, the future of the ShinyHunters "franchise" remains increasingly uncertain.
