Summary
A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. KrebsOnSecurity has learned that the suspect, who uses the hacker handle “Rey,” was detained as ShinyHunters was in the process of extorting a business unit recently divested by the global aerospace company Boeing, which manufactures the fleet of planes used by the employer of Rey’s father — Royal Jordanian Airlines.
The logo for Jeppesen ForeFlight, a business unit divested last year by the aerospace firm Boeing.
On October 3, Reuters cited three unnamed sources saying a suspected ShinyHunters member in Amman named Saif Al-din Khader was detained by Jordanian authorities and was cooperating with the FBI. KrebsOnSecurity identified Rey as Khader in a November 2025 profile, in which the young man admitted working with multiple ransomware groups.
Rey was featured again in a September 28 exclusive about the Dutch police arresting 24-year-old convicted cybercriminal Pepijn van der Stap on suspicion of aiding in data thefts and extortions by ShinyHunters. The story noted that immediately following the Dutchman’s arrest on the evening of September 15, Rey assumed control over the ShinyHunters brand and boasted publicly about stealing highly sensitive data from the FBI and extorting the ransomware group Cl0p.
Rey taunted both the FBI and Cl0p with memes posted to his longtime account on Twitter/X, while simultaneously including images of the avatar used by Van Der Stap’s former hacker alias “Umbreon” in an apparent attempt to frame the Dutchman for both hacks.
A taunting meme uploaded to Twitter/X by Rey on Sept. 22. A giant sized version of the Pokemon character Umbreon can be seen in the bottom left.
As noted in our September 28 report, ShinyHunters gained access to the FBI site and other victims by exploiting a vulnerability (CVE-2026-35273) in PeopleSoft, a software-as-a-service platform from the tech giant Oracle that is broadly used by companies to manage hiring and human resources, benefits and payroll. Oracle quickly issued a fix for CVE-2026-35273, which ShinyHunters first began exploiting as a zero-day in June, and at the time Mandiant released web application firewall rules intended for organizations that couldn’t apply the security update quickly enough.
ShinyHunters told BleepingComputer in June that the original goal behind exploiting the PeopleSoft vulnerability was to breach the FBI’s own PeopleSoft database, but the hackers said those attacks were unsuccessful for some reason. In recent weeks, however, ShinyHunters turned to a well-known URL-encoding trick to bypass Mandiant’s suggested web application firewall rules.
In a report released Sept. 25, security experts at Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters had mass-exploited the PeopleSoft vulnerability to steal data from dozens of systems across a range of industries, including higher education, technology, healthcare, agriculture, transportation and government.
Reuters reported October 5 that the FBI has removed a contractor at Accenture over their failure to patch the FBI recruitment website hacked by ShinyHunters, which exposed sensitive data on more than 5,000 FBI personnel, including each’s person’s unit and specialization, as well as medical and psychiatric records.
‘REY’ MEANS KING, AS IN ROYAL
According to two sources familiar with the ShinyHunters investigation, a navigation and digital aviation unit recently divested by the global aerospace company Boeing was among the victims that ShinyHunters was in the process of extorting when Rey was apprehended by Jordanian authorities.
Those sources said the FBI’s investigation into ShinyHunters gained renewed urgency with the group’s attempted extortion of the former Boeing unit, which allegedly included the theft of sensitive information that sources said could pose operational safety and security risks.
In a brief statement shared with KrebsOnSecurity, Boeing acknowledged the extortion attempts by ShinyHunters, and said the incident concerned data stolen from Jeppesen ForeFlight, a subsidiary that Boeing sold in November 2025 to the private equity firm Thoma Bravo for 200 million in damages and helped around 5–6 friend groups in the community make money by using Shiny Hunters group aliases to negotiate deals for a 25–30% cut over the past few months.”
In an interview with The Register, ShinyHunters claimed they hacked the FBI to counter the agency’s narrative in a May 2026 alert that advised victims against paying a ransom to the group, which came off looking unprofessional and capricious in the FBI’s advisory.
A flash notice on ShinyHunters released by the FBI on May 15, 2026.
The public notice warned the group has been known to pursue a number of different victim harassment strategies, from sending threatening text messages and phone calls to victims and their family members to in some cases swatting victims. The FBI warned ShinyHunters members “may also falsely claim to have sensitive or compromising information, including embarrassing photographs or videos of victims, which frequently do not exist.”
The hackers told The Register their attack on the FBI “demonstrated our technical capabilities and directly refuted the misinformation disseminated by the FBI, journalists, and industry researchers.” At the same time, the group’s leaders seemed to acknowledge that the FBI’s warning materially harmed their prospects for convincing victims to pay, saying “this was fundamentally a public relations and marketing initiative for our business.”
I think it’s important to take some of those conversations on the new Telegram channel with a grain of salt. ShinyHunters are known for their theatrics and strong OPSEC, and they have a long history of staging fake closures.
We know for sure that 15-year-old Saif Al-din Khader is affiliated with ShinyHunters, but we should be cautious about concluding he is definitely Rey / Hikki-chan, i.e one of the three core figures behind SHLH.
Rey asked to be contacted via @wristmug, which is the account that was de-anonymised. However, considering how wealthy these actors have become, that information could easily have been planted in exchange for a handsome payout, and Khader may have agreed to take the fall knowing that, as a minor, any sentence would be far more lenient.
I have quite a bit of OSINT indicating that the head of SHLH may be a British female who consistently refers to herself as “Queen” and “Royal,” tied to QAnon conspirituality and Charismatic Catholicism, with a Spanish partner involved named James/Jamie (mirroring “Rey”, with the female often using X for her name, hence ReyXBF).
These individuals are in their 30s, making them a whole lot more experienced in cybercrime than the kids getting arrested, and Jamie is very likely a former member of Anonymous.
These people live in very close proximity to the Russian diplomatic mission in the UK, and one of them I know for a fact has had regular contact with embassy-adjacent individuals.
Point is, SHLH is, in all likelihood, much more closely aligned with the accelerationism of The Com than the CTI community realises, and the FBI breach just further confirms this, but obviously happy to be proved wrong.
This is very interesting. Do you blog about this research anywhere?
The part of this story that should worry defenders most is the access path, not the arrests. ShinyHunters mass-exploited a PeopleSoft vulnerability for which Mandiant had already published WAF mitigations — and bypassed them with a URL-encoding trick. That’s a published mitigation that organizations simply didn’t implement, and it ended up exposing the FBI’s own recruitment data plus 70 organizations. It undercuts the common excuse that “we couldn’t have known.” The gap wasn’t threat intelligence, it was execution.
The franchise point resonates too. Arresting one teenager and watching the darknet site go offline looks like a win, but the brand just fragments into Telegram channels arguing over who the “real” ShinyHunters is. The Dread Pirate Roberts comparison is apt — succession doesn’t require anyone’s permission. Until the underlying access-broker pipeline (initial access via unpatched enterprise apps) is fixed, another Rey will pick up the brand.
One question for those tracking this: has anyone seen evidence that the PeopleSoft exploitation is still ongoing at organizations that applied only the WAF rules without patching?
die clanker
nice detrace that was definitely posted by a shiny hunter member trying to fend for his boy rey
The Battle is owned by the feds or contractors associated with them and is a propaganda wing, you can’t take much of what is said seriously the channel is used for harassment maybe of some who deserve it but they post addresses and doxes of people with their families addresses knowing home invasions and robberies are happening