A teenager residing in Amman, Jordan, suspected of acting as a principal leader of the prolific data theft and extortion syndicate known as ShinyHunters, has been detained by local authorities and is reportedly cooperating with the Federal Bureau of Investigation (FBI) to help identify other members of the hacking collective.
According to investigative findings by KrebsOnSecurity, the suspect—who operates online under the hacker handle “Rey”—was taken into custody just as the ShinyHunters network was actively engaged in an extortion attempt against a business unit recently divested by global aerospace giant Boeing. Notably, the employer of Rey’s father is Royal Jordanian Airlines, which operates a fleet of commercial passenger aircraft manufactured by Boeing.
The international enforcement action follows reports published on October 3 by Reuters, which cited three unnamed sources confirming that a suspected ShinyHunters operative in Amman named Saif Al-din Khader had been detained by Jordanian law enforcement and was actively assisting the FBI. KrebsOnSecurity previously identified Rey as Khader in a detailed investigative profile published in November 2025, during which the young man admitted to collaborating with multiple ransomware operations.
Rey’s activities drew renewed scrutiny following an exclusive report on September 28 detailing the arrest by Dutch police of 24-year-old convicted cybercriminal Pepijn van der Stap. Authorities suspect Van der Stap aided in data thefts and extortion campaigns orchestrated by ShinyHunters. Immediately following the dramatic Dutch police raid on the evening of September 15, Rey seized operational control of the ShinyHunters brand, publicly boasting about executing a high-profile cyberattack against the FBI and attempting to extort the established ransomware syndicate known as Cl0p.
Using his long-standing account on Twitter/X, Rey taunted both federal investigators and Cl0p operatives by publishing custom memes. Concurrently, he embedded images of the avatar utilized by Van der Stap during his former tenure under the hacker alias “Umbreon,” in an apparent maneuver to frame the Dutch national for both security breaches.
The Oracle PeopleSoft Zero-Day Vulnerability
As detailed in earlier reporting, ShinyHunters secured unauthorized access to the FBI’s online recruitment infrastructure and other corporate targets by aggressively exploiting a critical security vulnerability, tracked as CVE-2026-35273, affecting PeopleSoft. This software-as-a-service (SaaS) platform, developed by tech giant Oracle, is widely implemented across global enterprises to manage critical business operations including recruitment, human resources, employee benefits, and payroll systems.
Following the initial zero-day exploitation discovered in June, Oracle swiftly issued a security patch to remediate CVE-2026-35273. Simultaneously, cybersecurity firm Mandiant distributed defensive web application firewall (WAF) rules designed to protect organizations unable to immediately apply the software update.
Initial communications from ShinyHunters to tech publication BleepingComputer in June indicated that the primary objective behind the PeopleSoft exploit campaign was to breach the FBI’s proprietary database. While those initial attempts against the bureau were reportedly unsuccessful, ShinyHunters later adopted a well-known URL-encoding bypass technique to circumvent the protective WAF rules recommended by Mandiant.
A comprehensive threat intelligence report released on September 25 by experts at Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters carried out a mass-exploitation campaign targeting the PeopleSoft vulnerability. The attacks compromised data across dozens of organizations spanning diverse industry sectors, including higher education, technology, healthcare, agriculture, transportation, and government agencies.
Subsequent reports by Reuters on October 5 revealed that the FBI dismissed an IT contractor deployed through Accenture following their failure to patch the recruitment portal compromised by ShinyHunters. The breach exposed sensitive records belonging to more than 5,000 FBI personnel, detailing individual specializations, organizational units, and confidential medical and psychiatric documentation.
“Rey” Means King, as in Royal
Sources familiar with the ongoing international investigation into ShinyHunters confirmed that a navigation and digital aviation division recently divested by Boeing was among the active extortion targets when Jordanian authorities moved to apprehend Rey. Law enforcement sources indicated that the FBI’s pursuit of the hacking group gained considerable urgency following the targeting of the former Boeing asset, given that the stolen proprietary data presented potential operational safety and aviation security risks.
In a concise statement provided to KrebsOnSecurity, Boeing acknowledged the digital extortion threats directed at the company, verifying that the incident involved data illicitly acquired from Jeppesen ForeFlight. Boeing previously completed the sale of this subsidiary to private equity firm Thoma Bravo in November 2025 for $10.55 billion.
“We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight,” a Boeing spokesperson stated. “Estamos actively reviewing the matter with the Jeppesen ForeFlight team.”
Representing the subsidiary, a Jeppesen ForeFlight spokesperson issued a written statement emphasizing that corporate operations remained insulated from the breach. “Based on our investigation to date into this claim and proactive security posture, there was no impact to our operations or products.”
Rey’s alleged role in targeting the former Boeing division carries added significance due to documented evidence indicating his father is employed by Royal Jordanian Airlines. The airline, largely controlled by the Jordanian government, flies long-haul routes utilizing commercial aircraft manufactured by Boeing. Although Rey claimed on Telegram in early 2025 that his father worked as an airline pilot, that assertion could not be independently verified.
However, forensic analysis highlighted in the November 2025 profile of Rey revealed that a family computer utilized in their household had been compromised by password-stealing malware. Information recovered from the malware logs demonstrated that Rey’s father utilized identical authentication credentials across multiple online employee portals for Royal Jordanian Airlines.
Royal Jordanian Airlines did not respond to requests for comment regarding the security incident. Prior to the publication of the September 28 report, investigators contacted Rey’s father via email to apprise him of his son’s alleged cybercriminal activities. Neither family member responded to the inquiries. Nevertheless, within hours of that notification being sent, Rey began systematically scrubbing his digital footprint, deleting multiple social media profiles, including the Twitter/X handle previously used to taunt federal authorities and corporate victims.
Despite purging his primary social media accounts, Rey’s personal cybersecurity blog hosted on GitHub remained active, revealing a persistent obsession with the leadership cadre of the Cl0p ransomware operation. A lengthy technical post published on the blog in March 2026 explicitly doxxed two Russian individuals identified as the core developers and administrators orchestrating Cl0p.
Explosive Allegations in the Netherlands
Meanwhile, Dutch media outlets brought to light severe criminal allegations concerning Pepijn van der Stap, whose transition from a convicted cybercriminal to a reportedly reformed security professional had previously received positive coverage in technology circles. The prominent Dutch daily newspaper RTL reported on September 29 that investigators suspect Van der Stap attempted to orchestrate at least two contract murders to be carried out internationally, with indications pointing to him as the mastermind behind the planned attacks.
Van der Stap had previously been released from a Dutch correctional facility after completing the majority of a four-year prison sentence for data theft and extortion offenses that prosecutors estimated generated between €1.5 million and €2.7 million in illicit proceeds. In an interview conducted on September 9, Van der Stap characterized his professional status as the “offensive security lead” at Amsterdam-based cybersecurity firm Neo Security, explaining that his responsibilities included auditing client environments for infrastructure vulnerabilities.
Benjamin Korper, the owner of Neo Security, informed Reuters that he retained an independent auditing firm to determine whether Van der Stap had compromised Neo Security or its clientele. Initial findings revealed no evidence indicating malicious activity directed against his employer or its customers. Korper confirmed that Dutch forensic investigators entered his corporate offices on the evening of September 15 during the high-profile police raid that resulted in Van der Stap’s arrest, an operation that reportedly involved the deployment of flash-bang grenades by specialized tactical units.
Before his initial apprehension in 2023, Van der Stap maintained employment as a software engineer at Amsterdam cybersecurity startup Hadrian while concurrently volunteering with the Dutch Institute for Vulnerability Disclosure (DIVD)—all while secretly breaching and extorting major commercial entities.
When questioned about how the public or corporate partners could trust a self-professed reformed hacker who had deceived colleagues and investigators for years, Van der Stap maintained that his technical output defined his current trajectory. “You can throw a bunch of nice words at someone, but you can’t convince them if they don’t want to be convinced,” Van der Stap stated. “I’m doing what I can to repay victims, and that’s all I can do. If someone doesn’t want to believe me, then that’s on them.”
Franchising and Burning a Brand
Cybercriminals operating under the banner of ShinyHunters have been linked to dozens of major data breaches resulting in the exposure of billions of stolen records, with documented campaigns dating back to at least 2019. Security researchers note, however, that the individuals currently managing the ShinyHunters identity do not represent the original core members of the collective, the majority of whom are French nationals previously arrested and prosecuted for related cyber offenses.
Industry analysts characterize the modern incarnation of ShinyHunters as a franchise model. Parallels are frequently drawn to the fictional "Dread Pirate Roberts" persona from the cultural classic The Princess Bride, where succession is determined by law enforcement arrests rather than death, allowing multiple individuals to operate under the same moniker simultaneously. Sources close to the ongoing investigations indicate federal authorities are concentrating their efforts on a remaining faction of freelance cybercriminals who supply stolen credentials for corporate SaaS platforms in exchange for a percentage of subsequent extortion payouts.
Following the news of Van der Stap’s arrest, a Telegram chat server allegedly administered by Rey erupted with intense commentary. Participants heavily mocked the teenage hacker after he retreated from public threats directed at the FBI and Cl0p, a retreat quickly followed by the sudden offline status of the primary ShinyHunters darknet portal. Commentators accused Rey of appropriating the dormant ShinyHunters brand following the arrests of its original French members, subsequently degrading the group’s historical reputation.
“He bought the old forum PGP key and used it to make new Breachforum websites and Telegram channels larping as ShinyHunters to ransom companies and then sell the used data or resell his forum when he goes broke,” one community member observed.
A specialized Telegram tracking channel designated “The Battle” has persistently doxxed and criticized Rey alongside other alleged ShinyHunters affiliates, attracting a significant following within underground chat communities. Administrators of the channel portrayed Rey as an inexperienced participant attempting to capitalize on an established criminal brand known for ruthless data monetization tactics.
“Rey (Saif Al-Din Khader) made a serious mistake when he started pretending to be a member of ShinyHunters,” the administrators of The Battle channel wrote. “That group had already been dismantled, with many of its members either arrested or imprisoned, yet Rey still chose to use its name while carrying out his crimes. We’re aware of claims that [Rey] caused over $200 million in damages and helped around 5–6 friend groups in the community make money by using Shiny Hunters group aliases to negotiate deals for a 25–30% cut over the past few months.”
In a prior interview with The Register, representatives for ShinyHunters claimed their intrusion into FBI infrastructure was executed to counter public safety advisories published by the bureau. A formal flash notice issued by the FBI on May 15, 2026, explicitly warned organizations against yielding to extortion demands from the syndicate and detailed aggressive harassment techniques utilized by the group, including direct phone calls, threatening text messages, and swatting incidents targeting corporate executives and their families. Furthermore, the advisory cautioned that the group frequently misrepresents the scope of compromised data, claiming possession of sensitive or embarrassing photographs and videos that often do not exist.
While hackers operating under the brand argued that attacking the bureau demonstrated technical proficiency and refuted public safety warnings, group representatives implicitly acknowledged that the federal warnings severely undermined their ability to coerce corporate victims into paying ransoms, characterizing the digital incursions as a public relations maneuver designed to sustain their operations.
