A teenager from Amman, Jordan, suspected of leading the prolific data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the Federal Bureau of Investigation (FBI) to identify other members of the notorious hacking gang.

According to investigative reporting by KrebsOnSecurity, the suspect—who operates under the online handle “Rey”—was apprehended just as the cybercrime collective was in the midst of extorting a business unit recently divested by global aerospace giant Boeing. Coincidentally, the target of the extortion shares an indirect connection to the suspect’s family: the aviation unit manufactures the fleet of planes utilized by Royal Jordanian Airlines, the employer of Rey’s father.

International Arrests and the Fallout Within ShinyHunters

The developments unfolded following reports from Reuters, which cited three unnamed sources confirming that a suspected ShinyHunters member in Amman, identified as Saif Al-din Khader, was detained by Jordanian authorities and began cooperating with federal investigators. KrebsOnSecurity previously identified Rey as Khader in a November 2025 investigative profile, in which the young man admitted to collaborating with multiple ransomware operations.

Rey’s name resurfaced in late September 2025 during an exclusive report detailing the Dutch police’s arrest of 24-year-old convicted cybercriminal Pepijn van der Stap. Authorities suspected Van der Stap of aiding ShinyHunters in high-profile data thefts and corporate extortions. Immediately following the Dutchman’s dramatic arrest on the evening of September 15—which reportedly involved flash-bang grenades deployed by tactical police units in Amsterdam—Rey assumed control of the ShinyHunters moniker. He publicly boasted about infiltrating sensitive systems, stealing data from the FBI, and extorting the Cl0p ransomware gang.

In an apparent attempt to frame Van der Stap, Rey taunted both federal law enforcement and Cl0p operators using memes posted to his long-standing Twitter/X account. These posts prominently featured the avatar of "Umbreon," the former hacker alias utilized by Van der Stap.

The security community and investigators soon traced the mechanics of these breaches. As detailed in threat intelligence reports from Mandiant and the Google Threat Intelligence Group (GTIG), ShinyHunters had gained unauthorized access to the FBI recruitment website and numerous other corporate victims by exploiting a critical zero-day vulnerability, tracked as CVE-2026-35273, in Oracle PeopleSoft. This software-as-a-service platform is widely deployed across industries for human resources, recruitment, payroll, and benefits management.

Oracle quickly issued a patch after the vulnerability began seeing active exploitation in June, while Mandiant released web application firewall (WAF) rules for organizations unable to apply the security update immediately. Although ShinyHunters initially targeted the FBI’s PeopleSoft database with the goal of breaching the agency directly—an attempt that hackers claimed was largely unsuccessful—they later employed a URL-encoding bypass trick to circumvent Mandiant’s defensive rules.

The mass-exploitation campaign affected dozens of systems across higher education, technology, healthcare, agriculture, transportation, and government sectors. The fallout within federal contracting was swift; Reuters reported that the FBI removed a contractor at Accenture over failures to patch the recruitment portal, which exposed sensitive personal data belonging to more than 5,000 FBI personnel, including psychiatric records, medical files, and specific unit specializations.

"Rey" Means King, as in Royal

Investigators familiar with the ongoing ShinyHunters probe revealed that a navigation and digital aviation unit divested by Boeing was among the active targets of the group’s extortion attempts at the time of Rey’s apprehension. The targeting of this former Boeing subsidiary lent a renewed sense of urgency to the FBI’s investigation, given that the stolen proprietary data carried potential operational safety and security risks.

Boeing acknowledged the extortion threats in a statement to KrebsOnSecurity, confirming the incident involved data connected to Jeppesen ForeFlight. Boeing had sold this navigation subsidiary in November 2025 to private equity firm Thoma Bravo for $10.55 billion.

"We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight," a Boeing spokesperson stated, adding that the company was actively reviewing the situation alongside the ForeFlight team. Meanwhile, Jeppesen ForeFlight maintained that an internal investigation revealed no operational or product impact stemming from the incident.

The circumstances surrounding Rey’s involvement take on a personal dimension due to his family ties. Evidence indicates that Rey’s father is employed by Royal Jordanian Airlines, a carrier largely controlled by the Jordanian government that operates long-haul flights using Boeing aircraft. Although Rey claimed on Telegram early last year that his father worked as an airline pilot, that detail could not be independently verified.

However, digital forensics from a previous compromise of the family’s shared computer—exposed via password-stealing malware—showed that Rey’s father utilized identical credentials across multiple employee portals for Royal Jordanian Airlines. When KrebsOnSecurity reached out to Rey’s father for comment prior to publication, the outreach was met with silence. Within hours of the message being sent, however, Rey began frantically purging his social media footprint, scrubbing the Twitter/X accounts used to mock law enforcement and corporate victims.

Despite wiping his social media profiles, Rey’s cybersecurity blog hosted on GitHub remained active. A lengthy post published in March doxxed two Russian men identified by the teenager as the core developers and masterminds behind the Cl0p ransomware operation.

Murder-for-Hire Allegations Surface in the Netherlands

While the investigation into the younger hacker progressed in Jordan, explosive legal developments emerged in the Netherlands regarding Pepijn van der Stap. Dutch daily newspaper RTL reported that investigators harbor strong suspicions that Van der Stap attempted to orchestrate at least two murders abroad, allegedly issuing direct orders for the attacks.

These accusations compound existing charges against Van der Stap, who had recently been released from prison after serving the bulk of a four-year sentence for extortions and data thefts that prosecutors estimated netted between 1.5 million and 2.7 million euros. Prior to his September arrest, Van der Stap had cultivated a public persona as a reformed criminal, securing employment as an "offensive security lead" at Dutch cybersecurity firm Neo Security.

Neo Security owner Benjamin Korper told Reuters that an independent outside firm was hired to audit the company’s systems to determine if Van der Stap had compromised internal networks or client data. Investigators found no evidence of malicious activity directed at Neo Security, though forensic teams continue to examine the broader scope of his digital activities.

Before his initial conviction in 2023, Van der Stap worked as a software engineer at Amsterdam-based security startup Hadrian while volunteering with the Dutch Institute for Vulnerability Disclosure (DIVD)—all while maintaining a secret career as a corporate extorter. When questioned by reporters about how anyone could trust a self-described reformed hacker who deceived colleagues and friends for years, Van der Stap maintained that his subsequent rehabilitative efforts were the only answer he could offer critics.

Franchising and Burning a Brand

Cybercriminals operating under the ShinyHunters banner have been linked to dozens of major data breaches impacting billions of records since 2019. Security experts emphasize, however, that the individuals currently wielding the name bear little relation to the group’s early core members, many of whom are French nationals previously arrested by authorities.

Instead, ShinyHunters has evolved into a franchise model. Observers liken the succession to the fictional "Dread Pirate Roberts" from The Princess Bride, where the mantle is passed down not by death, but by arrest, and multiple figures may claim the title simultaneously. Federal investigators have increasingly focused on independent affiliates and freelancers who feed stolen software-as-a-service credentials to the network in exchange for a percentage of subsequent ransom payouts.

Following Van der Stap’s arrest and Rey’s subsequent detention, the cybercrime community on Telegram erupted in criticism. Participants in underground chat servers mocked Rey for folding under pressure from law enforcement and abandoning his threats against the FBI and Cl0p, particularly after the ShinyHunters darknet portal abruptly went offline. Commentators accused the teenager of purchasing legacy PGP keys and forum credentials to "larp" as the syndicate, damaging the group’s illicit reputation for financial gain.

Administrators of a specialized tracking channel on Telegram known as "The Battle" noted that Rey’s decision to co-opt the dismantled ShinyHunters brand proved to be his undoing. According to community estimates shared within underground forums, Rey and his associates managed to generate significant disruption and financial damages while negotiating corporate ransoms for a cut of the proceeds over the preceding months.

The group’s decision to publicly target the FBI earlier in the year was driven largely by public relations motives. Following a May flash notice issued by the FBI warning victims against paying ransoms to ShinyHunters—and detailing harassment tactics such as swatting and threatening phone calls—the hackers lashed out. In interviews with industry reporters, the actors claimed their breach of the FBI’s recruitment infrastructure was designed to counter the agency’s narrative and demonstrate technical competence, while privately conceding that law enforcement advisories had severely impaired their ability to convince corporate victims to pay.