Teenager identified as key leader of the notorious ShinyHunters hacking collective detained in Amman while cooperating with the FBI

The landscape of global cybercrime shifted dramatically this month following the detention of a teenager in Amman, Jordan, suspected of being a primary architect behind the recent resurgence of the prolific extortion group known as ShinyHunters. Identified as Saif Al-din Khader, known online by the handle "Rey," the suspect is currently in the custody of Jordanian authorities and is reportedly providing actionable intelligence to the Federal Bureau of Investigation (FBI) regarding the internal structure and affiliate network of the hacking gang. This development marks a significant turn in the FBI’s ongoing efforts to dismantle a group responsible for an unprecedented string of data thefts and high-profile extortion attempts targeting government agencies, aviation firms, and global tech providers.

The Rise and Fall of a Digital Franchise

ShinyHunters has functioned as a digital "franchise" for several years, evolving from its origins in 2019 to a modern, decentralized criminal operation. Unlike traditional, tightly-knit hacking syndicates, the current iteration of ShinyHunters acts as a loose coalition of freelance actors who leverage the established brand to lend legitimacy to their extortion demands. According to cybersecurity analysts, the group’s model functions similarly to the literary trope of the Dread Pirate Roberts—a title passed down to hide the true identity of the operator, or in this case, a brand hijacked by various opportunistic threat actors to facilitate ransom negotiations.

The investigation into Khader reached a critical threshold in September 2026. Following the arrest of 24-year-old Dutch national Pepijn van der Stap in Amsterdam on September 15, the "Rey" persona—previously linked to Khader—attempted to solidify his control over the brand. In a brazen display of digital bravado, Khader allegedly launched a series of cyberattacks against the FBI and the Cl0p ransomware group, utilizing memes and social media taunts to frame the incarcerated Van der Stap for these new breaches. These maneuvers, while intended to solidify his status as a kingpin, appear to have accelerated the law enforcement efforts that ultimately led to his identification and subsequent arrest in Jordan.

Chronology of Escalation: The Oracle PeopleSoft Exploitation

The technical foundation of the group’s recent campaign rested on the exploitation of CVE-2026-35273, a critical vulnerability within Oracle’s PeopleSoft platform. This software-as-a-service (SaaS) suite, widely used for managing human resources, payroll, and recruitment, became the primary vector for ShinyHunters’ 2026 offensive.

• June 2026: ShinyHunters begins exploiting a zero-day vulnerability in Oracle PeopleSoft. Initial attempts to breach the FBI’s internal database prove unsuccessful.
• July–August 2026: The group pivots, using URL-encoding techniques to bypass web application firewall (WAF) rules issued by security firm Mandiant, successfully exfiltrating data from dozens of organizations across the healthcare, government, and technology sectors.
• September 15, 2026: Dutch police conduct a high-profile raid in Amsterdam, arresting Pepijn van der Stap.
• September 22, 2026: Khader ("Rey") initiates a campaign of social media taunts, claiming responsibility for attacks on the FBI and attempting to frame the imprisoned Van der Stap.
• September 30, 2026: The primary ShinyHunters darknet portal goes offline following an FBI ultimatum.
• October 3, 2026: Reuters reports the detention of a suspect in Amman, Jordan, later confirmed to be Khader.

The Boeing Connection and Operational Risks

A focal point of the investigation involves the attempted extortion of a business unit formerly under the umbrella of the aerospace giant Boeing. Specifically, the data theft targeted Jeppesen ForeFlight, a navigation and digital aviation services provider that Boeing divested in late 2025 for over $10 billion.

The inclusion of an aviation-related target is particularly sensitive given the personal background of the suspect. Intelligence gathered by investigators suggests that Khader’s father maintains a position at Royal Jordanian Airlines, an entity that relies heavily on Boeing’s fleet for its international operations. While the extent of the father’s awareness remains unconfirmed, forensic evidence recovered from a compromised family computer in 2025 revealed that the same credentials used to access the suspect’s hacking tools were also used to log into internal Royal Jordanian Airlines employee portals.

Boeing issued a formal statement acknowledging the incident, noting, "We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight. We are actively reviewing the matter." For its part, Jeppesen ForeFlight has maintained that their operations and product integrity remain unaffected, asserting a "proactive security posture" that mitigated the impact of the intrusion.

Broader Implications: The FBI Breach and Contractor Accountability

The breach of an FBI recruitment portal by ShinyHunters earlier this year remains one of the most damaging episodes in the agency’s recent history. The incident exposed the sensitive personal, medical, and psychiatric records of more than 5,000 FBI personnel. Following an internal audit, the FBI confirmed the termination of an Accenture contractor responsible for the oversight of that specific website, citing a failure to implement necessary security patches that would have prevented the exploitation of the PeopleSoft vulnerability.

This breach highlights a systemic vulnerability in modern infrastructure: the reliance on third-party contractors and the slow pace of patch management for enterprise software. Security researchers at Google Threat Intelligence Group (GTIG) and Mandiant have characterized the ShinyHunters campaign as a "mass exploitation" event, emphasizing that the sheer scale of the automated attacks overwhelmed many organizations that failed to adapt to the shifting threat landscape.

A Turn Toward Violence?

The investigation into the broader ShinyHunters network has uncovered disturbing allegations that extend beyond digital theft. Dutch authorities are currently probing suspicions that Pepijn van der Stap, prior to his arrest, may have been involved in commissioning violence. Reports from RTL indicate that investigators are looking into claims that Van der Stap attempted to orchestrate at least two murders abroad.

These revelations provide a grim context to the "reformed hacker" persona Van der Stap attempted to project in the tech community. Despite serving a prior sentence for cybercrime, Van der Stap had secured a position as an "offensive security lead" at a Dutch cybersecurity firm, Neo Security, claiming to be committed to repairing the damage he had caused. The current evidence, including the tactical police raid involving flash-bang grenades, suggests that the reality of the criminal network was far more dangerous than the professional veneer presented to the public.

Analysis: The Fragility of Cybercriminal Brands

The collapse of the current ShinyHunters leadership demonstrates the inherent fragility of criminal "brands" built on anonymity and digital clout. By choosing to adopt a name with a history of law enforcement attention, Khader and his associates inadvertently painted targets on their own backs.

The "Battle" Telegram channel, which has been systematically doxing and harassing members of the group, serves as evidence of the fracturing of the cybercriminal underground. When a group becomes too visible—as ShinyHunters did by publicly mocking the FBI—they cease to be a covert threat and become a priority target for international intelligence agencies. The move by the FBI to publicly warn victims against paying ransoms was not merely a defensive measure; it was a strategic effort to starve the group of the capital necessary to sustain their operations.

As of mid-October 2026, the status of the ShinyHunters brand is in flux. With key figures in custody and the original infrastructure dismantled, the remaining affiliates face a choice: retreat into deeper obscurity or risk identification by the same intelligence dragnet that successfully identified Khader in Amman. The case underscores a critical takeaway for the industry: while the tools of cybercrime continue to evolve, the human element—the hubris of the individual operator—remains the most significant point of failure for criminal enterprises. The cooperation of Khader with federal authorities may provide the final pieces of the puzzle needed to close the chapter on this particular iteration of the ShinyHunters collective, though the underlying vulnerabilities in global software infrastructure remain a persistent concern.