A teenager residing in Amman, Jordan, who is suspected of acting as a key orchestrator for the prolific data theft and extortion collective known as "ShinyHunters," has been taken into custody by local authorities. Sources indicate that the suspect, who operates under the handle “Rey,” is currently cooperating with the Federal Bureau of Investigation (FBI) to assist in the identification and apprehension of other members within the notorious hacking syndicate.
The detention of the suspect—identified by KrebsOnSecurity as Saif Al-din Khader—occurred during a critical window as the group was actively engaged in an extortion campaign targeting a business unit recently divested by the global aerospace giant Boeing. In a striking convergence of digital crime and personal proximity, the business unit, Jeppesen ForeFlight, manufactures software for the very fleet of aircraft utilized by Royal Jordanian Airlines, the employer of the suspect’s father.
The Rise and Fall of ‘Rey’
The arrest of Khader was first reported on October 3 by Reuters, which cited three unnamed sources confirming that a suspected ShinyHunters member in Amman had been detained and was providing intelligence to U.S. federal authorities. This development marks a significant turning point in a long-running investigation into the group. Khader was previously profiled by KrebsOnSecurity in November 2025, during which he openly admitted to collaborating with multiple ransomware operations, positioning himself as a central figure in the modern cyber-extortion landscape.
The scope of Khader’s influence became particularly apparent following the September 28 arrest of 24-year-old Dutch national Pepijn van der Stap. Following the dramatic Dutch police raid—which reportedly involved the use of flash-bang grenades at the suspect’s residence—Khader seized control of the ShinyHunters brand. In a display of brazen confidence, he utilized his Twitter/X account to boast about successfully stealing highly sensitive data from the FBI and attempting to extort the notorious ransomware group Cl0p.
In an effort to obfuscate his own activities and deflect heat, Khader taunted both federal investigators and the Cl0p syndicate using memes. Notably, he integrated the avatar previously used by Van der Stap—a hacker alias known as “Umbreon”—into his posts, an apparent attempt to frame the incarcerated Dutchman for the high-profile hacks.
Exploiting the Oracle PeopleSoft Vulnerability
The technical foundation for these attacks was a critical vulnerability, tracked as CVE-2026-35273, found within Oracle’s PeopleSoft platform. PeopleSoft is a widely used software-as-a-service (SaaS) solution utilized by major enterprises to manage core human resources functions, including payroll, benefits, and hiring processes.
Although Oracle moved quickly to issue a security patch, ShinyHunters had been exploiting the vulnerability as a zero-day since June. While security firms like Mandiant released firewall rules to protect organizations that could not immediately apply the update, the hackers eventually developed a sophisticated URL-encoding bypass to circumvent these protections. Security researchers at Mandiant and the Google Threat Intelligence Group (GTIG) confirmed in a September 25 report that the group had used this exploit to conduct mass data theft across a diverse array of sectors, including healthcare, higher education, government, agriculture, and technology.
The fallout from these breaches has been severe. Reuters reported on October 5 that the FBI had terminated a contractor at Accenture after the firm failed to patch the agency’s recruitment website. The resulting breach exposed the sensitive personal data of more than 5,000 FBI personnel, including medical and psychiatric records, as well as specific information regarding their internal units and specializations.
The Boeing Connection and Family Ties
The investigation into Khader took on a heightened level of urgency when it was discovered that ShinyHunters was in the midst of extorting Jeppesen ForeFlight, a navigation and digital aviation subsidiary that Boeing sold to the private equity firm Thoma Bravo for $10.55 billion in November 2025. The FBI viewed the theft of this data as a matter of national and operational safety, given the sensitive nature of the information held by the aviation firm.
In a statement provided to KrebsOnSecurity, Boeing confirmed that they were aware of the extortion attempts and were working closely with the Jeppesen ForeFlight team to review the incident. For its part, Jeppesen ForeFlight maintained that their internal investigations and proactive security posture resulted in no operational impact to their products or services.
The connection to the suspect’s father remains a point of intense interest for investigators. Strong evidence indicates that the elder Khader is employed by Royal Jordanian Airlines, a government-controlled carrier that operates a long-haul fleet consisting primarily of Boeing aircraft. In early 2025, the suspect had claimed on Telegram that his father was an airline pilot, a detail that mirrors the security risks identified in earlier investigations. In late 2025, a compromise of the family’s shared computer by password-stealing malware revealed that the father used identical credentials to access multiple internal portals for Royal Jordanian Airlines employees, highlighting how a lack of digital hygiene can inadvertently expose critical infrastructure.
Following repeated inquiries from the media, the suspect reportedly began purging his digital footprint, including the deletion of the social media accounts he had used to taunt the FBI. Despite this, a GitHub blog maintained by Khader remained online, revealing his obsession with the inner workings of the Cl0p ransomware group. The blog featured a detailed investigation that identified two Russian men as the primary developers behind Cl0p, essentially “doxing” the operators of one of the most established ransomware gangs in the industry.
Allegations of Violence in the Netherlands
While Khader’s activities have focused on data theft and extortion, the allegations surrounding Pepijn van der Stap have taken a much darker turn. Dutch media outlets, including the daily publication RTL, reported on September 29 that investigators are probing whether Van der Stap attempted to orchestrate at least two murders abroad.
Van der Stap, who had recently completed a four-year prison sentence for previous cybercrimes, had been attempting to rebrand himself as a reformed professional. At the time of his arrest in September, he was employed as an “offensive security lead” at a Dutch cybersecurity firm, Neo Security. The owner of the firm, Benjamin Korper, has since hired an external investigation team to ensure that Van der Stap did not abuse his position to compromise the company or its clients.
When interviewed prior to his arrest, Van der Stap defended his transition into the security industry, claiming that he was focused on repaying his victims and moving forward. However, the revelation of these new, violent allegations has left his former associates and the public questioning the sincerity of his reformation.
The Fragility of the ShinyHunters Brand
The history of ShinyHunters reflects the evolving nature of cybercrime, where brands are often treated as franchises rather than static organizations. Experts note that the current operators are not the original members, many of whom were French citizens apprehended years ago. Instead, the name has been adopted by a shifting group of freelancers who feed stolen credentials to the collective in exchange for a percentage of the ransom proceeds.
The group’s recent activities have faced heavy ridicule from other cybercriminal factions, particularly after the darknet website associated with ShinyHunters went offline following an FBI ultimatum. Critics within the Telegram-based hacking community have accused Khader of being a “larper” who hijacked the reputation of a dismantled group to facilitate his own extortion schemes.
“He bought the old forum PGP key and used it to make new Breachforum websites and Telegram channels larping as ShinyHunters,” one commentator noted. The consensus among these observers is that Khader lacked the pedigree of the original group and ultimately damaged the brand’s efficacy.
In their communications with The Register, ShinyHunters claimed their decision to target the FBI was a marketing initiative designed to counter the agency’s public warnings against paying ransoms. The FBI’s May 2026 alert had specifically cautioned victims against the group’s harassment tactics, which have included swatting and the threat of leaking compromising personal media. While the group claimed their attacks demonstrated their “technical capabilities,” the arrest of their lead spokesperson suggests that the campaign has ultimately served to accelerate their downfall, bringing the long-running saga of the ShinyHunters brand closer to a permanent close.
