A teenage resident of Amman, Jordan, suspected of orchestrating the operations of the notorious data theft and extortion syndicate known as "ShinyHunters," has been taken into custody. According to reports, the suspect is currently cooperating with the Federal Bureau of Investigation, providing intelligence that may help authorities map the broader network of the prolific hacking group.
The suspect, who has operated under the hacker handle "Rey," was apprehended during a critical moment in the group’s operations. At the time of his detention, ShinyHunters was actively attempting to extort a business unit recently divested by the global aerospace giant Boeing. The irony of the target is particularly striking: the suspect’s own father is reportedly employed by Royal Jordanian Airlines, a carrier that relies heavily on a fleet of aircraft manufactured by the very company the group was attempting to compromise.
The Rise and Fall of ‘Rey’
The suspect, identified by investigators as Saif Al-din Khader, was previously the subject of an in-depth profile by KrebsOnSecurity in November 2025. Even then, the young man had been linked to various ransomware collectives, displaying a sophisticated—if reckless—knack for cyber-intrusion. His name surfaced again in early October 2026, when Reuters reported that an Amman-based suspect was in custody and working with federal agents.
The capture of Khader follows a volatile period for the ShinyHunters brand. On September 28, a separate report detailed the arrest of 24-year-old Pepijn van der Stap in the Netherlands. Van der Stap, a convicted cybercriminal, was accused of facilitating the group’s data theft and extortion schemes. In the immediate aftermath of the Dutch police raid on September 15, Khader—then still operating freely—took control of the ShinyHunters brand. He launched a public campaign of bravado, claiming credit for high-profile breaches of the FBI and the Cl0p ransomware group.
Khader’s behavior during this period was characterized by digital taunting. He utilized his long-standing account on X (formerly Twitter) to circulate memes mocking both the FBI and his rivals in the Cl0p syndicate. In a calculated effort to deflect heat from himself, he frequently incorporated the avatar of "Umbreon," the former handle of Van der Stap, in an apparent attempt to frame the Dutchman for the group’s most recent transgressions.
Exploiting the PeopleSoft Vulnerability
The group’s recent surge in activity was facilitated by a critical vulnerability, tracked as CVE-2026-35273, within Oracle’s PeopleSoft software. This platform is a ubiquitous tool in the corporate world, used extensively for human resources, payroll, and recruitment management.
ShinyHunters first began weaponizing this zero-day vulnerability in June. Despite rapid efforts by Oracle to issue patches and by security firm Mandiant to provide web application firewall (WAF) rules to mitigate the threat, the hackers remained persistent. When their initial attempts to breach the FBI’s specific PeopleSoft database proved unsuccessful, they shifted tactics. In recent weeks, the group utilized advanced URL-encoding techniques to bypass the security measures intended to block their access.
A joint report published on September 25 by Mandiant and the Google Threat Intelligence Group confirmed that the group had mass-exploited this vulnerability, siphoning sensitive data from dozens of organizations spanning the technology, healthcare, government, and transportation sectors. The human cost of these breaches was significant; reports indicate that an Accenture contractor was terminated by the FBI following a breach of a recruitment portal. That incident alone exposed the personal records of over 5,000 FBI personnel, including specialized unit information and confidential medical and psychiatric histories.
Extortion and the Boeing Connection
The investigation into Khader reached a fever pitch due to his targeting of a former Boeing subsidiary. The company in question, Jeppesen ForeFlight, was sold to private equity firm Thoma Bravo in November 2025. Sources close to the investigation noted that the FBI viewed this specific extortion attempt as a major escalation, given the potential for the stolen data to impact aviation safety and operational security.
Boeing issued a statement acknowledging the situation, noting that they were aware of claims regarding data linked to their former subsidiary. Jeppesen ForeFlight, however, maintained that its own internal investigation showed no impact on its current operations or product security.
The connection to Khader’s family remains a point of intense interest for investigators. Evidence from previous security incidents suggests that Khader’s family computer was compromised by credential-stealing malware. This breach revealed that his father, an employee of the state-controlled Royal Jordanian Airlines, frequently used the same passwords across various internal airline portals. While no official response has been received from the Khader family or the airline, the digital trail of the suspect’s life has been systematically scrubbed since his arrest. In the hours following inquiries from journalists, the younger Khader began deleting his social media presence, including the accounts used to taunt law enforcement.
A Pattern of Violence and Deception
The arrest of the Dutch suspect, Pepijn van der Stap, has brought to light allegations far more sinister than simple data theft. Dutch media outlet RTL reported that investigators suspect Van der Stap of orchestrating at least two contract murders. This revelation has shocked the cybersecurity community, as Van der Stap had spent much of the past year rebranding himself as a "reformed" hacker, eventually securing a position as an "offensive security lead" at a Dutch firm called Neo Security.
The dichotomy of Van der Stap’s public persona—a consultant hired to find vulnerabilities during the day, and a suspected criminal mastermind at night—has led to intense scrutiny of his former employers and the industry’s vetting processes. Despite the dramatic police raid that led to his arrest, Neo Security has stated that they have found no evidence that he compromised their systems or those of their clients.
The ShinyHunters Franchise
Industry experts characterize the modern iteration of ShinyHunters as a "franchise" rather than a traditional, centralized criminal organization. With the original core members—mostly French nationals—having been largely neutralized by law enforcement, the brand has been co-opted by various independent freelancers. These actors operate under the established name to instill fear, often sharing stolen credentials from SaaS platforms in exchange for a percentage of the ransom proceeds.
This decentralized model has led to a chaotic environment where multiple, unrelated groups claim the "ShinyHunters" title simultaneously. The group’s credibility, however, has taken a significant hit. The rise of community-led monitoring channels, such as a Telegram server known as "The Battle," has systematically exposed the group’s newer members. These observers have characterized Khader as a "clueless greenhorn" who merely bought access to old PGP keys to "LARP" as a notorious hacker, ultimately causing roughly $200 million in damages while burning through the brand’s reputation.
In an ironic twist, the hackers’ own public relations efforts backfired. Their attempt to hack the FBI, which they claimed was a response to an official agency warning against paying ransoms, ultimately served to highlight their own instability. By attacking the Bureau, they sought to project technical dominance, but in doing so, they only solidified their status as a high-priority target for international law enforcement. As the investigation into Khader continues, the once-fearsome brand of ShinyHunters appears to be fading, leaving behind a trail of compromised data and a new generation of suspects facing the reality of global cyber-policing.
