A teenager from Amman, Jordan, suspected of being a central figure in the prolific data theft and extortion syndicate known as "ShinyHunters," has been taken into custody. Sources indicate the suspect, who operates under the handle “Rey,” is currently cooperating with the Federal Bureau of Investigation (FBI) to help identify and dismantle other members of the hacking collective.
The arrest comes at a volatile time for the cybercrime group, which has been under intense international scrutiny following a string of high-profile attacks. According to information obtained by KrebsOnSecurity, the suspect’s detention occurred as ShinyHunters was actively attempting to extort a business unit recently divested by the global aerospace giant Boeing. In a striking intersection of digital crime and real-world infrastructure, the targeted unit provides services that support the aviation industry—the same sector that employs the father of the accused teenager, who is reportedly a staff member at Royal Jordanian Airlines.
The Rise and Fall of ‘Rey’
On October 3, Reuters reported that a suspected ShinyHunters member in Amman, identified as Saif Al-din Khader, had been detained by Jordanian authorities. This followed a November 2025 profile by KrebsOnSecurity, which first identified "Rey" as Khader. In that earlier report, the young man openly admitted to his involvement with multiple ransomware-affiliated groups, establishing a public footprint that would eventually draw the attention of federal investigators.
The trajectory of the ShinyHunters brand has been chaotic in recent months. On September 28, a report detailed the arrest of 24-year-old Dutch national Pepijn van der Stap, who was taken into custody by Dutch police on suspicion of facilitating the group’s data theft and extortion operations. Investigators believe Van der Stap, who previously operated under the alias "Umbreon," provided critical support to the gang.
In a calculated move following Van der Stap’s arrest on September 15, Rey assumed control of the ShinyHunters persona. He immediately engaged in a series of aggressive public displays, boasting about successfully exfiltrating sensitive data from the FBI and attempting to extort the notorious ransomware group Cl0p. To confuse investigators and shift blame, Rey utilized his Twitter/X account to post memes taunting the FBI, while intentionally embedding images of the "Umbreon" avatar used by Van der Stap, an apparent effort to frame the Dutchman for the group’s ongoing activities.
The Oracle PeopleSoft Exploitation Campaign
The group’s recent surge in activity was largely fueled by the exploitation of CVE-2026-35273, a critical vulnerability in Oracle’s PeopleSoft software. This platform, widely used by major corporations and government agencies for human resources, payroll, and recruitment, became the primary vector for ShinyHunters’ intrusions.
While Oracle acted quickly to release a security patch, the damage had already been done. ShinyHunters had been using the flaw as a zero-day exploit since June. Even after Mandiant released web application firewall (WAF) rules to help organizations mitigate the risk, the hackers—ever adaptive—employed URL-encoding tricks to bypass these protections.
A joint report published on September 25 by security experts at Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters had conducted a mass-exploitation campaign. The scope of the attacks was vast, impacting industries ranging from higher education and healthcare to agriculture, transportation, and government agencies.
One of the most damaging breaches involved the FBI’s own recruitment website. On October 5, Reuters reported that the FBI had removed an Accenture contractor for failing to apply necessary patches to the site. The resulting breach exposed highly sensitive information on more than 5,000 FBI personnel, including details regarding their medical and psychiatric records, as well as their specific units and specializations.
A Target Linked to the Suspect’s Roots
The attempted extortion of the former Boeing unit highlights the strange, often personal nature of these modern cyber-attacks. The victim, Jeppesen ForeFlight—a navigation and digital aviation unit sold by Boeing to private equity firm Thoma Bravo in November 2025—was in the crosshairs of ShinyHunters at the time of Khader’s arrest.
The FBI reportedly treated this particular extortion attempt with renewed urgency, fearing that the stolen data could compromise operational safety and security within the aviation sector. Boeing acknowledged the incident, stating that they were reviewing the matter with the Jeppesen ForeFlight team, while a spokesperson for the subsidiary maintained that their own internal operations and products remained unaffected.
The link between the suspect and the aviation industry is particularly noteworthy. Evidence suggests Khader’s father is employed by Royal Jordanian Airlines, a carrier controlled by the Jordanian government that relies heavily on Boeing aircraft. In early 2025, Rey claimed on Telegram that his father was an airline pilot. While that claim remains unverified, forensic analysis of a compromised computer belonging to the Khader family revealed that the father used identical login credentials for multiple employee portals at Royal Jordanian Airlines, suggesting that the household’s digital hygiene may have been a liability for the family.
Despite requests for comment sent by KrebsOnSecurity, the Khader family has remained silent. Shortly after the queries were sent, Rey began a rapid purge of his social media presence, including the Twitter/X account he had used to taunt law enforcement. However, his GitHub blog remained active, revealing his fixation on the inner workings of the Cl0p ransomware group. In a March 2026 post, he attempted to dox two Russian men, claiming they were the core operators behind Cl0p—a move that further cemented his reputation as an agent of chaos within the cybercrime ecosystem.
Explosive Allegations Against Van der Stap
As Khader faces the legal consequences of his actions in Jordan, his alleged associate, Pepijn van der Stap, is dealing with even more severe accusations in the Netherlands. Reports from the Dutch news outlet RTL suggest that investigators suspect Van der Stap of orchestrating at least two murders, allegedly to be carried out abroad.
This revelation stands in stark contrast to the persona Van der Stap cultivated following his release from prison for earlier cybercrimes. Having served the majority of a four-year sentence for extortion and data theft, Van der Stap had been publicly presenting himself as a reformed hacker. In a September 9 interview with KrebsOnSecurity, he claimed to be working as an "offensive security lead" at a Dutch firm called Neo Security.
The company’s owner, Benjamin Korper, has since hired an external firm to investigate whether Van der Stap used his position to compromise the firm or its clients. While the investigation is ongoing, the dramatic nature of Van der Stap’s arrest—which reportedly involved the use of flash-bang grenades by a special police unit—suggests that Dutch authorities viewed him as a significant threat.
The Franchise of Digital Extortion
The current iteration of ShinyHunters represents a departure from the group’s origins. Experts note that the original core members, mostly French nationals, have largely been apprehended or imprisoned. In their absence, the "ShinyHunters" name has become a franchise—a digital "Dread Pirate Roberts" scenario where multiple, disconnected actors adopt the brand to add weight to their extortion efforts.
These modern affiliates, including Khader, often act as freelancers, feeding stolen credentials from various SaaS platforms to the group in exchange for a percentage of the ransom payouts. This decentralized structure has made the group difficult to track, but it has also led to internal strife.
Within the cybercrime community on Telegram, many have turned on Rey, viewing him as a "larper" who diluted the group’s reputation. Commentators on a server known as "The Battle," which has been actively documenting and mocking the activities of ShinyHunters members, have described Rey as an inexperienced opportunist who sought to capitalize on the group’s notoriety long after its actual power had waned.
Ultimately, the hackers’ decision to target the FBI was a desperate attempt to regain control of the narrative. In a statement to The Register, ShinyHunters claimed their attack on the agency was a response to an FBI alert that warned victims against paying ransoms. The hackers admitted that the FBI’s warning had severely hindered their ability to extract money from victims, framing their retaliatory hack as a necessary marketing initiative. As the dust settles on these investigations, the case of "Rey" serves as a stark reminder of how thin the line has become between the geopolitical stage, critical infrastructure, and the reach of a teenager in a bedroom.
