Suspected ShinyHunters Leader Detained in Jordan Amid Extortion of Divested Boeing Unit

Suspected ShinyHunters Leader Detained in Jordan Amid Extortion of Divested Boeing Unit Jordanian authorities have detained Saif Al-din Khader, known online as 'Rey' and suspected of leading the extortion group ShinyHunters, who is reportedly cooperating with the FBI after targeting a divested Boeing aviation subsidiary and exploiting an Oracle PeopleSoft flaw to breach government and corporate networks. Suspected ShinyHunters leader Saif Al-din Khader ('Rey') was detained in Amman, Jordan, and is cooperating with the FBI. At the time of Rey's detention, the group was actively extorting Jeppesen ForeFlight, a former Boeing digital aviation unit sold to Thoma Bravo. ShinyHunters mass-exploited an Oracle PeopleSoft vulnerability (CVE-2026-35273) to breach numerous entities, including an FBI recruitment site exposing data on over 5,000 personnel. Dutch authorities arrested convicted hacker Pepijn van der Stap in connection with ShinyHunters, while separate allegations emerged that he ordered two murders abroad. Cybercrime observers and peers characterize modern ShinyHunters as a franchise where new actors like Rey adopted the brand after original French members were arrested. Detention in Jordan and the Boeing Spin-off Extortion Jordanian authorities detained Saif Al-din Khader, a teenager operating under the handle 'Rey,' who is reportedly cooperating with the FBI. The investigation escalated quickly because ShinyHunters was in the middle of extorting Jeppesen ForeFlight, a digital aviation and navigation business divested by Boeing to Thoma Bravo in November 2025. Boeing acknowledged the extortion claims and stated it is reviewing the issue alongside Jeppesen ForeFlight, while Jeppesen ForeFlight stated its operations and products sustained no impact. Mass Exploitation of Oracle PeopleSoft Vulnerability ShinyHunters leveraged a vulnerability in Oracle's PeopleSoft SaaS platform (CVE-2026-35273) to compromise systems across transportation, healthcare, government, and higher education. Although Oracle released a fix and Mandiant proposed web application firewall rules, the hackers bypassed those defenses using URL-encoding techniques. The breach of an FBI recruitment site led to the exposure of medical, psychiatric, and specialization records for over 5,000 personnel and prompted the removal of an Accenture contractor for failing to patch the system. Dutch Arrest and Murder Plot Allegations Against Van der Stap Prior to Rey's detention, Dutch police arrested 24-year-old convicted cybercriminal Pepijn van der Stap on suspicion of aiding ShinyHunters' data thefts. Following the arrest, Dutch media reported that investigators also suspect Van der Stap of ordering at least two overseas murders. Van der Stap, who previously claimed to be reformed and worked as an offensive security lead at Neo Security, was publicly mocked and framed by Rey, who posted taunts using Van der Stap's old online alias. Franchise Model and Internal Cybercrime Dissension Security researchers note that ShinyHunters has transitioned into a franchise model where new affiliates step into the brand once previous members are incarcerated, following the arrests of its original French core. Within cybercrime discussion channels on Telegram, participants and rivals criticized Rey for impersonating the defunct group, alleging he bought older forum keys to run extortion campaigns and took cuts of 25 to 30 percent while causing substantial damage.

ShinyHunters头目被捕前曾勒索波音剥离子公司，黑客组织加盟化内幕曝光 黑客勒索组织ShinyHunters的核心嫌疑人Rey（Saif Al-din Khader）在约旦被拘留并配合FBI调查。被捕前，该团伙正对波音剥离的数字航空子公司展开敲诈；与此同时，荷兰同伙涉重案被捕，暴露出该老牌黑客品牌已退化为由多方租用招牌的犯罪加盟网络。 约旦籍少年Rey被拘留前正勒索波音于2025年剥离的子公司Jeppesen ForeFlight，危及航空运营安全信息。 ShinyHunters利用Oracle PeopleSoft漏洞CVE-2026-35273攻击多家机构及FBI，泄露逾5000名FBI人员敏感数据。 荷兰警方逮捕了自诩“改邪归正”的黑客Pepijn van der Stap，其涉嫌参与ShinyHunters犯罪并被指控策划跨境谋杀。 安全专家与地下黑客社群披露，如今的ShinyHunters已演化为借用老品牌的加盟式犯罪模式，核心成员多遭替换。 约旦头目Rey落网与波音子公司勒索案 约旦当局逮捕了黑客代号为Rey的10多岁少年Saif Al-din Khader，其正配合FBI调查。消息人士透露，Rey落网时ShinyHunters正在勒索波音此前以105.5亿美元出售给私募公司的Jeppesen ForeFlight业务部门，被盗敏感数据或引发运营安全风险。波音承认已知晓相关敲诈事件，但Jeppesen ForeFlight称未见运营受到实质影响。调查还发现Rey的父亲在皇家约旦航空工作，该航司主要机队正是波音客机。 大规模利用PeopleSoft漏洞入侵FBI及各行各业 ShinyHunters利用Oracle旗下PeopleSoft软件的零日漏洞（CVE-2026-35273）发起广泛攻击。尽管官方发布了补丁和防火墙规则，该团伙仍通过URL编码绕过WAF，入侵了教育、医疗、政府等多个领域的数十个系统。受埃森哲外包商未打补丁影响，FBI招聘网站失陷，超5000名人员的部门、专长及心理健康档案外泄。该团伙声称入侵FBI是为了回击FBI预警、维持勒索“商业信誉”的公关举动。 荷兰同伙Van der Stap涉嫌买凶谋杀被捕 荷兰警方于9月15日突袭逮捕了24岁的已定罪黑客Pepijn van der Stap。此人此前宣称改邪归正并担任Neo Security的进攻性安全主管，但据荷兰媒体报道，调查人员怀疑他涉嫌下令在境外策划至少两起谋杀。在其被捕当晚，Rey曾接管ShinyHunters品牌并高调宣称攻击了FBI和Cl0p勒索软件团伙，甚至试图栽赃给Van der Stap。 ShinyHunters的“特许经营”化与圈内内讧 专家指出，当前运作ShinyHunters的人员已非早期的法国核心成员，该团伙已变成类似“恐怖海盗罗伯茨”的特许经营网络：老成员被捕后，外部黑客通过购买旧论坛密钥、提供凭证加盟分成的方式继续借用其名号。在Telegram地下频道中，黑客群体指责Rey拉大旗作虎皮，不仅在面临执法压力时退缩导致暗网站点下线，还充当掮客协助同伙敛财并造成数亿美元损失。

A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group **ShinyHunters** has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. KrebsOnSecurity has learned that the suspect, who uses the hacker handle “**Rey**,” was detained as ShinyHunters was in the process of extorting a business unit recently divested by the global aerospace company **Boeing**, which manufactures the fleet of planes used by the employer of Rey’s father — **Royal Jordanian Airlines**. On October 3, **Reuters** [cited](https://www.reuters.com/world/middle-east/key-shinyhunters-hacker-detained-jordan-is-cooperating-sources-say-2026-10-03/) three unnamed sources saying a suspected ShinyHunters member in Amman named **Saif Al-din Khader** was detained by Jordanian authorities and was cooperating with the FBI. KrebsOnSecurity identified Rey as Khader in [a November 2025 profile](https://krebsonsecurity.com/2025/11/meet-rey-the-admin-of-scattered-lapsus-hunters/), in which the young man admitted working with multiple ransomware groups. Rey was featured again in [a September 28 exclusive](https://krebsonsecurity.com/2026/09/dutch-police-arrest-reformed-hacker-in-shiny-hunters-investigation/) about the Dutch police arresting 24-year-old convicted cybercriminal **Pepijn van der Stap** on suspicion of aiding in data thefts and extortions by ShinyHunters. The story noted that immediately following the Dutchman’s arrest on the evening of September 15, Rey assumed control over the ShinyHunters brand and boasted publicly about stealing highly sensitive data from the **FBI** and extorting the ransomware group **Cl0p**. Rey taunted both the FBI and Cl0p with memes posted to his longtime account on Twitter/X, while simultaneously including images of the avatar used by Van Der Stap’s former hacker alias “**Umbreon**” in an apparent attempt to frame the Dutchman for both hacks. As noted in our September 28 report, ShinyHunters gained access to the FBI site and other victims by exploiting a vulnerability (CVE-2026-35273) in **PeopleSoft**, a software-as-a-service platform from the tech giant **Oracle** that is broadly used by companies to manage hiring and human resources, benefits and payroll. Oracle quickly issued a fix for CVE-2026-35273, which ShinyHunters first began exploiting as a zero-day in June, and at the time Mandiant released web application firewall rules intended for organizations that couldn’t apply the security update quickly enough. ShinyHunters [told BleepingComputer in June](https://www.bleepingcomputer.com/news/security/oracle-peoplesoft-servers-hacked-in-shinyhunters-data-theft-attacks/) that the original goal behind exploiting the PeopleSoft vulnerability was to breach the FBI’s own PeopleSoft database, but the hackers said those attacks were unsuccessful for some reason. In recent weeks, however, ShinyHunters [turned to a well-known URL-encoding trick](https://www.bleepingcomputer.com/news/security/shinyhunters-uses-waf-bypass-trick-in-oracle-peoplesoft-attacks/) to bypass Mandiant’s suggested web application firewall rules. In [a report](https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft) released Sept. 25, security experts at **Mandiant** and the **Google Threat Intelligence Group** (GTIG) confirmed that ShinyHunters had mass-exploited the PeopleSoft vulnerability to steal data from dozens of systems across a range of industries, including higher education, technology, healthcare, agriculture, transportation and government. Reuters [reported October 5](https://www.reuters.com/technology/accenture-contractor-removed-fbi-following-damaging-data-breach-sources-say-2026-10-06/) that the FBI has removed a contractor at **Accenture** over their failure to patch the FBI recruitment website hacked by ShinyHunters, which exposed sensitive data on more than 5,000 FBI personnel, including each’s person’s unit and specialization, as well as medical and psychiatric records. According to two sources familiar with the ShinyHunters investigation, a navigation and digital aviation unit recently divested by the global aerospace company **Boeing** was among the victims that ShinyHunters was in the process of extorting when Rey was apprehended by Jordanian authorities. Those sources said the FBI’s investigation into ShinyHunters gained renewed urgency with the group’s attempted extortion of the former Boeing unit, which allegedly included the theft of sensitive information that sources said could pose operational safety and security risks. In a brief statement shared with KrebsOnSecurity, Boeing acknowledged the extortion attempts by ShinyHunters, and said the incident concerned data stolen from **Jeppesen ForeFlight**, a subsidiary that Boeing [sold in November 2025](https://www.reuters.com/business/aerospace-defense/buyout-firm-thoma-bravo-nears-deal-boeings-jeppesen-unit-bloomberg-news-reports-2025-04-22/) to the private equity firm Thoma Bravo for $10.55 billion. “We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight,” a Boeing spokesperson shared. “We are actively reviewing the matter with the Jeppesen ForeFlight team.” A spokesperson for Jeppesen ForeFlight shared a written statement in response to questions, saying the company has seen no impact on their end. “Based on our investigation to date into this claim and proactive security posture, there was no impact to our operations or products.” Rey’s alleged involvement in attempting to extort the former Boeing unit is noteworthy because there is strong evidence that his father works for **Royal Jordanian Airlines**, which is mostly controlled by the Jordanian government and operates its long-haul fleet on passenger planes built by Boeing. Rey claimed on Telegram in early 2025 that his father was an airline pilot, although that could not be independently confirmed. However, as noted in [our November 2025 profile of Rey](https://krebsonsecurity.com/2025/11/meet-rey-the-admin-of-scattered-lapsus-hunters/), his family’s shared computer was at one point compromised by password-stealing malware, and the data collected by that malware clearly shows Rey’s father used the same credentials to log in at multiple online portals for Royal Jordanian Airlines employees. Royal Jordanian Airlines has not yet responded to a request for comment. In advance of our September 28 story, KrebsOnSecurity once again emailed Rey’s father to seek comment and update him on his son’s alleged activities. Neither of the Khaders have responded. But just hours after that request was sent, Rey began deleting his various social media accounts, including the Twitter/X account he previously used to taunt the FBI, Cl0p, and other ShinyHunters victims. Rey may have nixed many of his social media profiles, but his cybersecurity blog on GitHub somehow escaped the purge, and it shows that Rey was fixated on the leaders of the Cl0p ransomware group. In March 2026, Rey’s blog featured [a lengthy post](https://rmoskovy.github.io/posts/who-runs-clop-ransomware-investigation/) that identified two Russian men as the core developers and hackers behind Cl0p. Meanwhile, news outlets in the Netherlands reported explosive new allegations leveled at Van der Stap, whose supposed personal transformation from convicted to reformed hacker has been widely covered in the tech news media. The Dutch daily [RTL reported on Sept. 29](https://www.rtl.nl/nieuws/binnenland/artikel/5656154/pepijn-van-der-s-verdacht-van-opdracht-geven-moorden) that investigators suspect Van der Stap tried to orchestrate at least two murders. According to RTL, the murders were allegedly to be committed abroad, and there are indications Van der Stap gave the order for these attacks. Van der Stap was released from prison after serving the better part of a four year sentence for data theft and extortion activity that prosecutors said netted between €1.5 million and €2.7 million. In an interview with KrebsOnSecurity on September 9, Van der Stap described his new role as “offensive security lead” at the Dutch cybersecurity company **Neo Security**, saying the job involved probing client networks for security vulnerabilities. Neo Security’s owner **Benjamin Korper** told Reuters he has hired an outside firm to investigate whether Van der Stap had hacked Neo Security or its customers, but that so far investigators have found no evidence he acted against his employer or clients. Korper said Dutch forensic investigators visited his office on September 15, the night Van der Stap was arrested in a dramatic police raid that reportedly involved [flash bang grenades](https://www.at5.nl/artikelen/239945/speciale-eenheid-rivierenbuurt-amsterdam). Prior to his first arrest in 2023, Van der Stap was working as a software engineer at the Amsterdam-based cybersecurity startup Hadrian, while volunteering at the Dutch Institute for Vulnerability Disclosure (DIVD) — even as he was hacking into and extorting a number of large organizations. When asked in a recent interview why anyone should believe the word of a self-described “reformed” cybercriminal who had so casually deceived countless friends, co-workers and journalists for years, Van der Stap replied that his work spoke for itself and there was nothing he could say that would convince his worst critics. “You can throw a bunch of nice words at someone, but you can’t convince them if they don’t want to be convinced,” Van der Stap told KrebsOnSecurity on Sept. 9. “I’m doing what I can to repay victims, and that’s all I can do. If someone doesn’t want to believe me, then that’s on them.” Cybercriminals aligned with ShinyHunters have been responsible for [dozens of data breaches](https://en.wikipedia.org/wiki/ShinyHunters) involving billions of stolen records, and breaches claimed by the group stretch back to at least 2019. But experts say the people recently operating behind the ShinyHunters name are not the same core members that populated the group in its early days, most of whom are French citizens who have been arrested (if not also imprisoned) on [at least one prior occasion](https://krebsonsecurity.com/wp-content/uploads/2026/10/k3l0t3x.png) for alleged cybercrime activity. More to the point, ShinyHunters has become something of a franchise. Think the [Dread Pirate Roberts](https://en.wikipedia.org/wiki/Dread_Pirate_Roberts) character in the 1980s cult movie classic “The Princess Bride,” only succession by death is replaced with succession by arrest, and there can be multiple simultaneous Dread Pirate Robertses. Sources close to the investigation say the FBI is focusing on a remaining handful of cybercriminal freelancers or affiliates who have been feeding the group stolen credentials to various software-as-a-service (SaaS) platforms used by major companies in exchange for a cut of any data ransoms later paid by victims. In the days after the news broke of Van der Stap’s arrest, a cybercrime-focused chat server on Telegram that was allegedly operated by Rey erupted with hot takes, with most participants heaping ridicule on the teenage hacker after he publicly backed down from threats against the FBI and Cl0p, and again when [the ShinyHunters’s darknet website suddenly went offline](https://www.reuters.com/legal/government/shinyhunters-website-goes-offline-after-fbi-deadline-expires-2026-09-30/). Several commentators accused Rey of resurrecting the ShinyHunters brand after its core members were rounded up in France, and making a mockery of the group’s name and reputation ever since. “He bought the old forum PGP key and used it to make new Breachforum websites and Telegram channels larping as ShinyHunters to ransom companies and then sell the used data or resell his forum when he goes broke,” one member recounted. A relatively new Telegram channel called “The Battle” has been doxing and needling Rey and other alleged ShinyHunters members for several weeks, and it has gained a considerable readership among the cybercrime communities operating on Telegram. One of the coordinators of that harassment campaign repeatedly portrayed Rey as clueless greenhorn who sought to ride the coattails of a cybercriminal brand that has long enjoyed a reputation for ruthlessly selling or publishing data stolen from victim companies who refuse to give in to extortion demands. “Rey (Saif Al-Din Khader) made a serious mistake when he started pretending to be a member of ShinyHunters,” wrote the administrators of The Battle server on Telegram. “That group had already been dismantled, with many of its members either arrested or imprisoned, yet Rey still chose to use its name while carrying out his crimes. We’re aware of claims that \[Rey\] caused over $200 million in damages and helped around 5–6 friend groups in the community make money by using Shiny Hunters group aliases to negotiate deals for a 25–30% cut over the past few months.” In an interview with [The Register](https://www.theregister.com/cyber-crime/2026/09/25/shinyhunters-tells-the-reg-we-hacked-the-fbi-to-protect-our-business/5299250), ShinyHunters claimed they hacked the FBI to counter the agency’s narrative in [a May 2026 alert](https://www.ic3.gov/PSA/2026/PSA260515) that advised victims against paying a ransom to the group, which came off looking unprofessional and capricious in the FBI’s advisory. The public notice warned the group has been known to pursue a number of [different victim harassment strategies](https://krebsonsecurity.com/2026/02/please-dont-feed-the-scattered-lapsus-shiny-hunters/), from sending threatening text messages and phone calls to victims and their family members to in some cases [swatting](https://krebsonsecurity.com/tag/swatting/) victims. The FBI warned ShinyHunters members “may also falsely claim to have sensitive or compromising information, including embarrassing photographs or videos of victims, which frequently do not exist.” The hackers told The Register their attack on the FBI “demonstrated our technical capabilities and directly refuted the misinformation disseminated by the FBI, journalists, and industry researchers.” At the same time, the group’s leaders seemed to acknowledge that the FBI’s warning materially harmed their prospects for convincing victims to pay, saying “this was fundamentally a public relations and marketing initiative for our business.”