A teenage resident of Amman, Jordan, suspected of acting as a central figure and brand administrator for the prolific and destructive data theft and extortion collective known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with federal investigators. According to findings from KrebsOnSecurity, the suspect—who operates online under the hacker handle “Rey”—was taken into custody just as the loose collective was attempting to extort a major business unit recently divested by global aerospace giant Boeing.
The dramatic convergence of events highlights the fluid, decentralized, and often chaotic nature of modern cybercrime syndicates. The suspect’s alleged targeting of a former Boeing subsidiary carries an ironic personal dimension: the employer of Rey’s father is Royal Jordanian Airlines, a carrier that operates long-haul passenger fleets manufactured almost entirely by Boeing.
On October 3, Reuters cited three unnamed sources confirming that a suspected ShinyHunters member in Amman, identified as Saif Al-din Khader, had been detained by Jordanian authorities and was actively assisting the FBI. KrebsOnSecurity had previously unmasked Rey as Khader in a detailed investigative profile published in November 2025, during which the young man openly acknowledged historical associations with multiple ransomware and extortion operations.
Rey’s activities drew renewed global attention following a September 28 exclusive report detailing the arrest of 24-year-old Dutch cybercriminal Pepijn van der Stap by law enforcement officers in the Netherlands. Van der Stap, a convicted felon, was apprehended on suspicion of facilitating data thefts and financial extortions for ShinyHunters. Investigators noted that almost immediately following Van der Stap’s arrest on the evening of September 15, Rey seized operational control of the dormant ShinyHunters brand. Capitalizing on the public vacuum, Rey launched a high-profile public relations campaign, boasting about infiltrating the FBI and attempting to extort the notorious ransomware syndicate Cl0p.
In a series of aggressive digital taunts, Rey utilized his long-standing account on Twitter/X to share mocking memes directed at both federal law enforcement and the Cl0p ransomware operators. Cunningly, he interspersed these posts with avatars formerly associated with Van der Stap’s old hacking alias, “Umbreon,” in what investigators believe was a calculated attempt to frame the incarcerated Dutchman for the high-stakes breaches.
The technical gateway for these high-profile incursions relied heavily on a critical vulnerability tracked as CVE-2026-35273. This security flaw targeted PeopleSoft, an enterprise software-as-a-service (SaaS) platform developed by tech conglomerate Oracle and widely deployed across global enterprises for human resources, payroll, and recruitment administration. Oracle rushed out a security patch after ShinyHunters began weaponizing the zero-day flaw in June. Simultaneously, Mandiant issued emergency web application firewall (WAF) mitigation rules for organizations unable to apply Oracle’s patch immediately.
According to communications shared with BleepingComputer in June, ShinyHunters initially targeted the PeopleSoft vulnerability with the express intention of compromising the FBI’s internal recruitment database, though those early attempts were reportedly met with initial roadblocks. In subsequent weeks, however, the hackers bypassed Mandiant’s protective WAF rules by employing a classic URL-encoding obfuscation trick.
A joint threat intelligence report published on September 25 by Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters had successfully executed a mass-exploitation campaign against the PeopleSoft vulnerability. The attacks compromised data across dozens of organizations spanning diverse sectors, including higher education, healthcare, agriculture, transportation, technology, and government entities.
Further compounding the fallout, Reuters reported that the FBI removed an Accenture contractor following a damaging data breach tied to the unpatched recruitment portal. That specific incident exposed deeply sensitive records belonging to more than 5,000 FBI personnel, including operational specializations, unit assignments, and confidential medical and psychiatric files.
"Rey" Means King, as in Royal
According to sources familiar with the ongoing international investigation into ShinyHunters, the digital aviation and navigation unit divested by Boeing was squarely in the crosshairs of the group’s extortion demands when Jordanian law enforcement moved in to arrest Rey.
The attempted extortion of the former Boeing subsidiary alarmed federal investigators, given the sensitive nature of the proprietary navigation and flight data involved, which insiders warned could introduce operational safety and aviation security risks if leaked or mishandled.
In a statement provided to KrebsOnSecurity, Boeing acknowledged the extortion pressure from ShinyHunters, confirming that the threat actors claimed to hold proprietary data originating from Jeppesen ForeFlight. Boeing had previously sold the specialized navigation subsidiary in November 2025 to private equity firm Thoma Bravo in a transaction valued at $10.55 billion.
"We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight," a Boeing spokesperson stated, adding that the corporation is actively reviewing the incident alongside the Jeppesen ForeFlight security team. Representatives for Jeppesen ForeFlight maintained that their internal investigation revealed no adverse impact on ongoing operations or commercial products.
The proximity of Rey’s alleged extortion activities to aviation giants gains added intrigue through his familial ties. Evidence uncovered during security reviews indicated that Rey’s father utilized shared family computing hardware, logging into administrative portals for Royal Jordanian Airlines using credentials later exposed by password-stealing malware. Royal Jordanian Airlines—a carrier operating wide-body Boeing aircraft—did not respond to requests for comment.
Following inquiries from investigative journalists, Rey systematically purged his digital footprint, scrubbing multiple social media profiles, including the Twitter/X handle used to taunt federal agents and ransomware cartels. However, a cybersecurity blog maintained by Rey on GitHub remained active, revealing a deep fixation on the inner workings of rival cybercriminal gangs. A lengthy post published on the blog in March 2026 attempted to dox two Russian individuals alleged to be the core developers and masterminds behind the Cl0p ransomware enterprise.
Murder-for-Hire Allegations in the Netherlands
While federal agencies focused on the digital extortion rings, Dutch media outlets unveiled shocking criminal allegations concerning Pepijn van der Stap. Despite his public rebranding as a reformed hacker and his employment as an "offensive security lead" at Amsterdam-based firm Neo Security, investigative reports published by the Dutch daily RTL revealed that local prosecutors suspect Van der Stap of attempting to commission at least two murders abroad.
Van der Stap had previously served the majority of a four-year prison sentence for extensive data theft and extortion crimes that netted between €1.5 million and €2.7 million. Following his release, he secured employment probing client networks for vulnerabilities. Neo Security owner Benjamin Korper confirmed that external forensic auditors were immediately retained following Van der Stap’s dramatic September 15 arrest—which reportedly involved specialized police units deploying flash-bang grenades—though initial reviews found no evidence that Van der Stap had compromised his employer or clients.
Before his initial legal troubles in 2023, Van der Stap worked as a software engineer for Amsterdam startup Hadrian while volunteering for the Dutch Institute for Vulnerability Disclosure (DIVD), quietly maintaining a dual life as an active extortionist. When questioned about the credibility of his rehabilitation, Van der Stap maintained that his technical output and remediation efforts were the only metrics that mattered. "I’m doing what I can to repay victims, and that’s all I can do," he remarked prior to his second arrest.
Franchising and Burning a Brand
Security researchers emphasize that the individuals currently operating under the banner of ShinyHunters bear little resemblance to the group’s original founders, most of whom are French nationals previously apprehended by law enforcement. Over the years, ShinyHunters evolved from a closed cell into a decentralized criminal franchise—functioning much like the fictional "Dread Pirate Roberts" persona, where the brand persists across successive generations of operators.
In this modern iteration, freelance cybercriminals and affiliates feed stolen software credentials to whoever controls the brand in exchange for a percentage of any successfully negotiated ransoms. Following Van der Stap’s arrest, underground Telegram channels associated with Rey erupted in ridicule as the young hacker abruptly backed down from threats against the FBI and Cl0p, shortly before the primary ShinyHunters dark web portal went offline.
Critics within underground chat forums accused Rey of co-opting the legendary moniker to inflate his own status, noting that he purchased legacy PGP keys to launch fraudulent forums and Telegram channels. Observers suggested his primary motive was generating quick financial payouts by reselling stolen corporate data or auctioning off forum access when personal funds ran low.
Publicly, the actual collective behind ShinyHunters claimed responsibility for targeting the FBI to counter what they characterized as misleading public safety advisories. In a May 2026 flash notice, the FBI warned organizations against paying ransoms and detailed the group’s aggressive tactics, which have historically included direct telephonic harassment, swatting, and false claims regarding the possession of sensitive personal media.
While the physical arrest of Saif Al-din Khader in Amman and the sweeping legal actions against affiliates in Europe have severely disrupted the infrastructure of the current ShinyHunters iteration, federal investigators continue to track the remaining network of freelance intruders and credential brokers who sustain the modern cybercrime economy.
