Executive Overview
The landscape of international cybercrime has shifted dramatically following a high-profile detention in Amman, Jordan. Saif Al-din Khader—a teenager widely known in underground forums by the hacker handle “Rey”—has been detained by local authorities and is reportedly cooperating with the Federal Bureau of Investigation (FBI). Khader, identified in previous investigations as an administrator operating across multiple ransomware and extortion ecosystems, allegedly assumed control of the notorious ShinyHunters brand following a series of European law enforcement raids.
The investigation reached a fever pitch as Khader and his associates turned their sights on high-value aerospace assets, specifically targeting a navigation and digital aviation unit recently divested by global aerospace titan Boeing. This move catalyzed intense international pressure, culminating in Khader’s apprehension.
Concurrently, European authorities have disrupted ancillary cells connected to the collective. Dutch police arrested 24-year-old convicted cybercriminal Pepijn van der Stap—operating under the former alias “Umbreon”—amidst a dramatic raid in Amsterdam. Van der Stap, who had publicly reinvented himself as a white-hat security professional at a Dutch cybersecurity firm, now faces staggering additional allegations involving conspiracy to commit murder abroad.
This multi-pronged crackdown illustrates the evolving nature of modern cybercriminal syndicates. No longer centralized cartels, groups like ShinyHunters operate as fragmented, franchise-style enterprises akin to a digital "Dread Pirate Roberts." By exploiting zero-day vulnerabilities in ubiquitous enterprise software—most notably Oracle PeopleSoft—these decentralized affiliates have orchestrated massive data-theft campaigns across global industries, culminating in a direct, albeit disastrous, confrontation with federal law enforcement agencies.
Detailed Chronology
The June Zero-Day and the Oracle PeopleSoft Campaign
The current saga traces its roots back to June, when ShinyHunters initiated a mass-exploitation campaign targeting Oracle PeopleSoft, a foundational software-as-a-service (SaaS) platform used extensively for enterprise human resources, payroll, and recruitment management.
Leveraging a critical zero-day vulnerability tracked as CVE-2026-35273, the threat actors successfully breached dozens of high-profile corporate, educational, and governmental networks. While Oracle moved swiftly to issue patches, and cybersecurity firm Mandiant released web application firewall (WAF) mitigation rules, the hackers adapted rapidly. Utilizing a well-known URL-encoding technique to bypass WAF defenses, ShinyHunters continued their campaign unabated.
Internal communications revealed that the group’s initial, audacious objective was to infiltrate the FBI’s own PeopleSoft recruitment databases. Though direct penetration of the bureau’s database proved initially elusive, the campaign successfully compromised an unsecured FBI recruitment portal via an Accenture contractor who had failed to apply critical patches. This breach exposed sensitive personnel records belonging to more than 5,000 FBI employees, including unit assignments, specializations, and confidential medical and psychiatric files.
September Escalations: Arrests, Mems, and Darknet Disruption
The operational tempo accelerated dramatically in mid-September:
- September 15: Dutch police executed a high-impact raid utilizing flash-bang grenades in Amsterdam’s Rivierenbuurt neighborhood, arresting 24-year-old Pepijn van der Stap. Investigators quickly scrutinized Van der Stap’s activities, suspecting him of aiding ShinyHunters’ extortion schemes.
- September 16–22: Seizing upon the vacuum left by Van der Stap’s arrest, Saif Al-din Khader (“Rey”) aggressively hijacked the ShinyHunters identity. Operating from Amman, Rey launched a public relations and extortion campaign, boasting on Twitter/X about data thefts from the FBI and attempts to extort the rival ransomware syndicate Cl0p. In an effort to muddy investigative waters, Rey peppered his taunting memes with avatars associated with Van der Stap’s former alias, “Umbreon.”
- September 25: Mandiant and the Google Threat Intelligence Group (GTIG) published a joint threat intelligence report detailing the systemic, cross-industry exploitation of the PeopleSoft vulnerability, impacting sectors spanning healthcare, higher education, agriculture, and government.
- September 28: Investigative reports surfaced highlighting not only Van der Stap’s cyber offenses but explosive new allegations from Dutch daily RTL, suggesting Van der Stap was under investigation for orchestrating at least two contract murders abroad.
- September 30: Following an explicit FBI ultimatum and escalating pressure, the primary ShinyHunters darknet infrastructure and leak websites went offline.
October: The Boeing Nexus and Khader’s Detention
As October dawned, the dragnet tightened around Rey. On October 3, Reuters cited multiple intelligence sources confirming that Saif Al-din Khader had been detained by Jordanian authorities and was actively cooperating with the FBI.
Crucially, sources familiar with the investigation revealed that Khader’s ultimate undoing was an aggressive, high-risk extortion attempt targeting Jeppesen ForeFlight, a digital navigation and aviation subsidiary previously owned by Boeing and sold to private equity firm Thoma Bravo in November 2025 for $10.55 billion. The theft of proprietary aviation data—deemed capable of introducing operational safety risks—forced federal agencies to elevate the pursuit of the ShinyHunters leadership to maximum priority.
Supporting Context & Metrics
The Franchise Model of Cybercrime
The modern incarnation of ShinyHunters bears little resemblance to the original French nationals who founded the collective around 2019, most of whom have long since been apprehended or imprisoned. Instead, the moniker has become a decentralized franchise.
Cybersecurity analysts compare the structure to the fictional "Dread Pirate Roberts" from The Princess Bride: when one leader is arrested or burned, another assumes the mantle. Today’s ShinyHunters operate as an loose affiliation of freelance cybercriminals and initial access brokers (IABs). These affiliates harvest corporate credentials—often via password-stealing malware—and feed them into SaaS platforms, subsequently splitting ransom payouts with regional negotiators.
Rey’s Local Footprint and the Royal Jordanian Connection
Saif Al-din Khader’s cyber activities intersected uncomfortably with his immediate family. Digital forensics from previous malware infections on Khader’s family computer revealed that his father—reported to be an airline pilot for Royal Jordanian Airlines—utilized identical credentials across multiple internal airline employee portals.
Compounding the irony, Royal Jordanian Airlines operates its long-haul passenger fleet almost exclusively on aircraft manufactured by Boeing, the very corporate ecosystem Khader targeted through his extortion of Jeppesen ForeFlight. Following investigative inquiries sent to his family, Khader systematically scrubbed his social media presence, though his technical footprint remained visible on GitHub repositories where he casually doxxed alleged core operators of the Cl0p ransomware strain.
Official Statements
The fallout from the dual takedowns has prompted measured responses from impacted corporations and security entities:
-
Boeing: A corporate spokesperson acknowledged the extortion attempts tied to its former subsidiary:
"We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight. We are actively reviewing the matter with the Jeppesen ForeFlight team."
-
Jeppesen ForeFlight: Maintaining a robust security stance, a company representative emphasized operational continuity:
"Based on our investigation to date into this claim and proactive security posture, there was no impact to our operations or products."
-
Neo Security & Benjamin Korper: Following the arrest of their newly hired "offensive security lead," Pepijn van der Stap, neo-security management defended their vetting processes while cooperating with authorities. Owner Benjamin Korper noted that independent forensic audits commissioned immediately following the September 15 raid revealed no evidence that Van der Stap had compromised the firm or its clientele.
-
ShinyHunters (via The Register): In prior statements justifying their attacks against federal infrastructure, the group framed their actions as counter-messaging against public FBI advisories:
"Our attack on the FBI demonstrated our technical capabilities and directly refuted the misinformation disseminated by the FBI, journalists, and industry researchers… this was fundamentally a public relations and marketing initiative for our business."
Future Outlook
The simultaneous neutralization of Pepijn van der Stap in Amsterdam and Saif Al-din Khader in Amman marks a watershed moment in the disruption of modern ransomware and data extortion operations. However, industry experts warn that dismantling individual nodes does not eradicate the underlying threat ecosystem.
- The Persistence of Access Brokers: As long as initial access brokers can monetize corporate oversights—such as unpatched enterprise software like Oracle PeopleSoft—new personalities will emerge to resurrect defunct darknet brands.
- Increased Geopolitical Cooperation: Khader’s detention in Jordan highlights an increasingly cooperative international cybersecurity posture, wherein Middle Eastern authorities are increasingly willing to partner with Western law enforcement to curb transnational cybercrime.
- Corporate Supply-Chain Vulnerabilities: The incident underscores the critical necessity of stringent third-party vendor management. The compromise of FBI personnel data via an unsecured contractor portal at Accenture serves as a sobering reminder that an enterprise’s security posture is only as robust as its weakest supply-chain link.
As Khader continues his debriefing with federal investigators and Dutch prosecutors prepare their case against Van der Stap—spanning multi-million-euro extortion rings and shocking allegations of violent conspiracy—the digital underground faces a period of acute instability, forced to reckon with the reality that even the most elusive online personas remain tethered to the physical world.
