A teenager from Amman, Jordan, suspected of operating as a key leader of the prolific data theft and extortion syndicate known as ShinyHunters, has been detained and is reportedly cooperating with the Federal Bureau of Investigation to help identify other members of the notorious hacking gang.

According to investigative reporting from KrebsOnSecurity, the suspect—who operates online under the hacker handle "Rey"—was taken into custody just as ShinyHunters was actively engaged in extorting a business unit recently divested by global aerospace giant Boeing. In a striking twist of geopolitical and corporate proximity, the targeted aerospace division manufactures the fleet of aircraft utilized by the employer of Rey’s father: Royal Jordanian Airlines.

The detention first came to light when Reuters cited three unnamed sources confirming that Jordanian authorities had detained a local resident named Saif Al-din Khader in Amman. KrebsOnSecurity subsequently linked the handle "Rey" to Khader, referencing an earlier profile published in November 2025 in which the young man openly admitted to collaborating with multiple ransomware and extortion syndicates.

The pressure on Rey intensified following an exclusive report regarding the Dutch police arresting 24-year-old convicted cybercriminal Pepijn van der Stap on suspicion of assisting ShinyHunters with data thefts and extortions. Immediately following Van der Stap’s dramatic arrest on the evening of September 15, Rey seized control of the ShinyHunters brand online, publicly boasting about breaching the FBI and extorting the rival Cl0p ransomware operation.

Using his long-standing account on Twitter/X, Rey published a series of taunting memes directed at both the FBI and Cl0p. Simultaneously, he embedded images of the avatar utilized by Van der Stap’s former hacker alias, "Umbreon," in an apparent, calculated attempt to frame the Dutch national for the high-profile digital intrusions.

The breaches carried out by ShinyHunters—including the attempted compromise of the FBI’s digital infrastructure—relied heavily on the exploitation of a critical security vulnerability, tracked as CVE-2026-35273, affecting Oracle PeopleSoft. PeopleSoft is a widely deployed software-as-a-service platform utilized by corporations and government entities alike to manage human resources, payroll, recruitment, and employee benefits.

Oracle swiftly issued a security patch after the zero-day flaw was weaponized by ShinyHunters starting in June. Simultaneously, cybersecurity firm Mandiant released targeted web application firewall (WAF) rules to protect organizations unable to immediately apply Oracle’s software updates.

While BleepingComputer reported in June that the hackers initially targeted the FBI’s PeopleSoft database with mixed results, the group later bypassed Mandiant’s defensive measures. Utilizing a well-known URL-encoding evasion trick, ShinyHunters managed to circumvent the suggested WAF rules, according to subsequent analysis.

In a joint threat intelligence report released on September 25, experts from Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters had carried out a mass-exploitation campaign targeting the PeopleSoft vulnerability. The attacks impacted dozens of enterprise systems across critical sectors, spanning higher education, technology, healthcare, agriculture, transportation, and government agencies.

Further compounding the fallout, Reuters reported that the FBI removed an Accenture contractor following a damaging data breach. The security failure allowed ShinyHunters to infiltrate the bureau’s recruitment portal, exposing sensitive files belonging to more than 5,000 FBI personnel, including individual unit assignments, specializations, and confidential medical and psychiatric records.

"Rey" Means King, as in Royal

Investigators familiar with the ongoing ShinyHunters probe revealed that a navigation and digital aviation unit divested by Boeing was directly in the crosshairs of ShinyHunters’ extortion schemes when Rey was apprehended by Jordanian law enforcement. The FBI’s investigation took on renewed urgency due to this specific target, given that the stolen data from the former Boeing unit allegedly introduced severe operational safety and security risks.

In a brief official statement, Boeing confirmed awareness of the extortion attempt targeting data associated with Jeppesen ForeFlight, a subsidiary that Boeing sold to private equity firm Thoma Bravo for $10.55 billion in November 2025.

"We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight," a Boeing spokesperson stated, adding that the corporation is actively reviewing the incident alongside the Jeppesen ForeFlight team. Jeppesen ForeFlight similarly released a statement confirming that its ongoing investigation has revealed no operational impact or compromise to its products.

Rey’s alleged role in extorting the former Boeing subsidiary draws intense scrutiny given his familial ties to Royal Jordanian Airlines. The airline, largely controlled by the Jordanian government, operates its long-haul passenger fleet using aircraft designed and manufactured by Boeing. Although an early 2025 claim by Rey on Telegram that his father was an airline pilot could not be independently verified, a previous cybersecurity profile of Rey painted a clearer technical picture.

Evidence gathered from a password-stealing malware infection on the Khader family’s shared computer revealed that Rey’s father utilized identical credentials to log into multiple administrative portals reserved for Royal Jordanian Airlines employees.

Royal Jordanian Airlines has not responded to requests for comment regarding the security incident. Leading up to the publication of previous investigative reports, journalists reached out to Rey’s father to inform him of his son’s alleged cybercriminal activities. Neither of the Khaders responded publicly. However, just hours after the inquiries were transmitted, Rey began systematically purging his digital footprint, deleting numerous social media profiles—including the Twitter/X account used to mock law enforcement and victimized organizations.

Despite scrubbing his social media presence, Rey left behind a cybersecurity blog hosted on GitHub. A lengthy investigative post published on the blog in March 2026 exposed two Russian men as the core developers and operators behind the Cl0p ransomware syndicate, effectively doxing senior figures within the cybercrime underground.

Murder-for-Hire Allegations

While federal authorities closed in on the young Jordanian suspect, Dutch news media outlets published explosive new allegations regarding Pepijn van der Stap. The Dutch daily RTL reported that investigators suspect Van der Stap attempted to orchestrate at least two murders to be carried out abroad, pointing to indications that the former hacker gave direct orders for the violent plots.

Van der Stap had recently been released from prison after serving the majority of a four-year sentence for data theft and extortion activities that prosecutors estimated yielded between 1.5 million and 2.7 million euros. Prior to his September 15 arrest, Van der Stap presented himself as a rehabilitated citizen, granting interviews describing his new professional role as an "offensive security lead" at Dutch cybersecurity firm Neo Security, where he claimed to test client networks for vulnerabilities.

Benjamin Korper, the owner of Neo Security, told Reuters that he retained an outside forensic firm to investigate whether Van der Stap had compromised his company or its clients. Investigators have found no evidence of internal malicious activity so far. Korper confirmed that Dutch forensic police raided his office on the night Van der Stap was apprehended, an operation local media reported involved the use of flash-bang grenades.

Before his initial 2023 conviction, Van der Stap worked as a software engineer at Amsterdam-based cybersecurity startup Hadrian while concurrently volunteering for the Dutch Institute for Vulnerability Disclosure (DIVD)—all while secretly breaching and extorting major global enterprises. When questioned about how the public or victims could trust a self-described reformed hacker, Van der Stap maintained that his actions and rehabilitation efforts spoke for themselves.

Franchising and Burning a Brand

Security researchers point out that the cybercriminals currently operating under the ShinyHunters banner are distinct from the group’s original core members, most of whom are French citizens who have previously faced arrest and imprisonment for cybercrime. Over the years, ShinyHunters has evolved from a tight-knit collective into a decentralized franchise model.

Investigators compare the group’s operational structure to the fictional "Dread Pirate Roberts" from The Princess Bride, where succession occurs not through death, but through law enforcement arrests, often resulting in multiple individuals claiming the mantle simultaneously. Current FBI investigations are heavily concentrated on a network of freelance affiliates who feed stolen SaaS platform credentials to the brand in exchange for a percentage of any successful ransoms extracted from corporate victims.

In the wake of Van der Stap’s arrest, a Telegram chat server allegedly managed by Rey became a hub of criticism. Community members ridiculed the teenager after he backed down from public threats against the FBI and Cl0p, and as the primary ShinyHunters darknet portal abruptly went offline following an ultimatum from federal law enforcement.

Commentators in cybercrime forums accused Rey of co-opting the historical ShinyHunters brand simply to monetize stolen data and boost his own standing after the original members were dismantled by authorities in France. Observers noted that Rey utilized acquired PGP keys and forum infrastructure to launch substitute breach forums and Telegram channels, operating primarily as a broker negotiating extortion cuts for allied cybercriminal cells.

The ongoing fallout highlights the evolving intersection of decentralized extortion syndicates, corporate divestitures, and international law enforcement cooperation. As investigations continue in both Amman and Europe, the dismantling of these networks underscores the persistent vulnerability of enterprise software platforms to sophisticated, franchise-style cybercriminal groups.