A teenager from Amman, Jordan, suspected of serving as a primary architect behind the notorious data theft and extortion collective known as "ShinyHunters," has been taken into custody. Sources indicate that the suspect, who operates under the hacker handle "Rey," is currently cooperating with the Federal Bureau of Investigation (FBI) to help identify and track down other high-ranking members of the hacking syndicate. This significant breakthrough comes as the group was in the midst of an aggressive extortion campaign targeting a business unit recently divested by the global aerospace giant Boeing.
The suspect, identified by reports as Saif Al-din Khader, has long been a figure of interest in the cybersecurity community. His detention marks a major shift in the ongoing investigation into the group’s operations. The irony of the timing is particularly striking: the business unit targeted by ShinyHunters—Jeppesen ForeFlight—is a navigation and digital aviation firm that manufactures the software and tools essential for the very fleet of aircraft operated by the employer of Khader’s father, Royal Jordanian Airlines.
The Rise and Fall of ‘Rey’
The journey toward this arrest has been documented over several months. In a November 2025 profile, KrebsOnSecurity identified the individual behind the "Rey" handle as Khader, a young man who had already admitted to his involvement with multiple high-profile ransomware groups. His notoriety grew following a September 28 report detailing the arrest of 24-year-old Dutch cybercriminal Pepijn van der Stap, who was apprehended by police in Amsterdam on suspicion of facilitating data thefts for ShinyHunters.
Following the arrest of Van der Stap, who was known in hacking circles as "Umbreon," Rey moved to solidify his control over the ShinyHunters brand. In a brazen display of ego and audacity, Rey took to his Twitter/X account to boast about stealing sensitive data from the FBI and extorting the infamous ransomware group "Cl0p." To further complicate the investigation and shift blame, Rey posted taunting memes that prominently featured the avatar of Van der Stap, a calculated attempt to frame the Dutchman for the group’s ongoing exploits.
The FBI’s involvement in the case gained critical momentum following the group’s exploitation of a severe vulnerability in Oracle’s PeopleSoft software, tracked as CVE-2026-35273. This vulnerability, which allows unauthorized access to human resources, payroll, and benefits systems, became a primary vehicle for ShinyHunters to infiltrate dozens of high-value targets across industries ranging from healthcare and technology to government and higher education. Despite Oracle’s swift release of a patch and Mandiant’s guidance on firewall rules, the group utilized advanced URL-encoding techniques to bypass security measures, demonstrating a level of technical sophistication that kept security researchers on high alert for months.
The Boeing Connection and Operational Risks
The scope of the group’s activities became increasingly dangerous when they targeted Jeppesen ForeFlight. Boeing, which divested the unit in November 2025 to the private equity firm Thoma Bravo for $10.55 billion, confirmed that it was aware of the extortion attempts. While Jeppesen ForeFlight maintained that their internal operations and products remained unaffected, the FBI reportedly viewed the extortion of a major aviation data firm as a significant escalation that posed potential operational safety and security risks.
The personal connection between the suspect and the aviation industry has not gone unnoticed by investigators. Evidence gathered during previous investigations—specifically from a family computer that had been compromised by password-stealing malware—revealed that Khader’s father utilized consistent credentials to access various employee portals for Royal Jordanian Airlines. While the airline has not provided comment on these findings, the intersection of a teenager allegedly targeting aviation infrastructure while his father manages the day-to-day operations of an airline that relies on such infrastructure highlights the complex and often deeply personal nature of modern cybercrime.
In response to mounting pressure and the news of his son’s activities, Khader’s digital footprint began to vanish. Following inquiries from investigators, Rey systematically scrubbed his social media accounts, including the platforms where he had previously taunted federal authorities. Nevertheless, his digital trail remains partially visible through a GitHub blog, where he previously published a detailed analysis and "doxing" report identifying the core operators of the Cl0p ransomware group—a move that likely earned him few friends within the broader, often volatile cybercriminal ecosystem.
A Turn Toward Violence?
The investigation into the broader ShinyHunters network has taken an even darker turn with the emergence of allegations against Pepijn van der Stap. Dutch media outlets, including RTL, reported that investigators are looking into claims that Van der Stap, despite his public persona as a "reformed" hacker now working in "offensive security," may have orchestrated at least two contract murders.
The arrest of Van der Stap on September 15 was carried out in a high-intensity police raid involving flash-bang grenades, a stark departure from the typical treatment of non-violent cybercriminals. This escalation suggests that European authorities possess significant evidence linking the suspect to activities far more grave than mere digital extortion. For his part, Van der Stap had previously maintained that his transition to a security role at Neo Security was a legitimate attempt to make amends for his past, an argument that now appears to be under intense scrutiny by both his employer and Dutch forensic investigators.
The Fragmented ‘ShinyHunters’ Brand
Experts note that the ShinyHunters of 2026 bears little resemblance to the original group that surfaced in 2019. The brand has essentially become a franchise—a decentralized collection of freelancers and opportunists who use the name to gain leverage in ransom negotiations. Much like the mythical "Dread Pirate Roberts," the title of "ShinyHunters" is now a mantle assumed by various actors, each looking to monetize stolen credentials from software-as-a-service (SaaS) platforms.
The recent collapse of the ShinyHunters’ darknet presence and the subsequent ridicule of "Rey" by his peers on Telegram underscore the fragility of these criminal alliances. Within the Telegram channels where these actors communicate, many have dismissed Rey as a "greenhorn" who recklessly attempted to capitalize on a name that had already been dismantled by international law enforcement. The administrators of a prominent monitoring channel known as "The Battle" have been particularly vocal, accusing Rey of causing upwards of $200 million in damages while masquerading as a leader of a group that was already effectively defunct.
The group’s attempt to hack the FBI, while ostensibly a "public relations and marketing initiative" designed to counter the agency’s warnings against paying ransoms, ultimately served to bring the full weight of the bureau’s resources down upon them. By targeting the FBI, the group ensured that their activities moved from the realm of corporate crime to a matter of national security, accelerating the hunt for their members. As the FBI continues to process the information provided by the detained suspect in Jordan, the saga of ShinyHunters serves as a stark reminder of how quickly the landscape of cybercrime can shift—and how, for those operating in the shadows, the reputation they build can just as quickly become their undoing.
