Anatomy of a Cyber-Extortion Collapse: How the Detention of “Rey” and Dutch Raids Unraveled the Modern ShinyHunters Syndicate

GLOBAL CYBERCRIME INVESTIGATION — In the murky underworld of international data theft and cyber extortion, few brands command the instant terror and notoriety of ShinyHunters. Responsible for stealing billions of records over half a decade, the collective has long functioned not as a tightly knit traditional cell, but as a decentralized franchise—a digital iteration of the Dread Pirate Roberts where monikers and infrastructure are inherited, repurposed, and weaponized by successive generations of threat actors.

Today, that franchise is facing an unprecedented systemic collapse.

Recent law enforcement operations spanning Amman, Jordan, and Amsterdam have dismantled key leadership figures within the network. Central to this dramatic unraveling is the detention of a teenager from Amman known by the hacker handle “Rey”—identified by investigative journalists as Saif Al-din Khader. Detained by Jordanian authorities, Khader is reportedly cooperating with the Federal Bureau of Investigation (FBI) to identify remaining members of the hacking syndicate.

Khader’s apprehension coincides with explosive international fallout involving hacked federal recruitment portals, Oracle PeopleSoft zero-days, international hit-for-hire investigations, and an audacious, high-stakes extortion attempt targeting a recently divested aerospace subsidiary of Boeing—a company tightly linked to the very livelihood of Khader’s own family.

Main Facts: The Fall of "Rey" and the Dutch Connection

The contemporary iteration of ShinyHunters is far removed from the French nationals who founded the brand in 2019. In recent months, the group’s operations have been steered by opportunistic digital freelancers and young affiliates capitalizing on legacy fear.

The turning point for the current syndicate arrived in mid-September 2026, executed across two continents:

1. The Amsterdam Raid: On the evening of September 15, 2026, Dutch police—utilizing flash-bang grenades in a dramatic tactical raid in Amsterdam—arrested 24-year-old Pepijn van der Stap. A convicted cybercriminal recently operating under the persona of a "reformed" security expert, Van der Stap was apprehended on suspicion of orchestrating massive data thefts and extortions alongside ShinyHunters. Compounding these charges, Dutch daily RTL reported that investigators suspect Van der Stap of ordering at least two contract murders abroad.
2. The Amman Detention: Following Van der Stap’s arrest, Saif Al-din Khader (“Rey”) aggressively stepped into the power vacuum, seizing control of the ShinyHunters brand, claiming responsibility for breaches of the FBI, and taunting both law enforcement and the rival Cl0p ransomware cartel. However, this bravado was short-lived. By early October, sources confirmed Khader had been detained by Jordanian authorities and was actively cooperating with the FBI.

The dismantling of these two figures exposes the fragile, chaotic underbelly of modern cyber-extortion cartels, where youthful hubris, personal vendettas, and loose operational security frequently override technical sophistication.

Chronology of a Crisis: From Zero-Day Exploits to the FBI Breach

The events leading to the current downfall of ShinyHunters began unfolding earlier this year, driven by aggressive mass-exploitation campaigns and escalating confrontations with federal law enforcement.

• June 2026: ShinyHunters begins exploiting a critical zero-day vulnerability (CVE-2026-35273) affecting PeopleSoft, an enterprise SaaS platform by Oracle widely used for payroll, human resources, and hiring. While initial plans targeted the FBI’s internal PeopleSoft infrastructure directly, those specific database intrusions were reportedly unsuccessful.
• July – August 2026: Organizations across higher education, healthcare, technology, and government are systematically compromised as the group pivots to mass exploitation. Security researchers at Mandiant and the Google Threat Intelligence Group (GTIG) issue emergency warnings, releasing web application firewall (WAF) rules to block the onslaught.
• May 15, 2026: The FBI issues a public flash notice advising organizations never to pay ransoms to ShinyHunters, detailing their aggressive offline harassment tactics, including swatting and intimidation calls.
• September 15, 2026: Dutch police raid the residence of Pepijn van der Stap, arresting the former hacker-turned-cybersecurity consultant.
• September 22, 2026: Seizing the reins of the syndicate, "Rey" posts a series of chaotic memes to Twitter/X, openly taunting the FBI and Cl0p while strategically embedding the avatar of Van der Stap’s former alias, "Umbreon," in an attempt to frame the Dutchman for the attacks.
• September 25, 2026: Mandiant and GTIG release comprehensive telemetry confirming mass exploitation of Oracle PeopleSoft systems globally. Simultaneously, ShinyHunters grants interviews claiming their attacks on the FBI were designed to counter federal public warnings that had crippled their business model.
• September 30, 2026: Following an FBI ultimatum and ticking deadlines, the primary darknet infrastructure and leak sites associated with ShinyHunters go completely offline.
• October 3, 2026: Reuters cites three unnamed sources confirming that Saif Al-din Khader has been detained in Amman, Jordan, and is assisting the FBI.
• October 5–6, 2026: Reports surface that the FBI has terminated an Accenture contractor whose failure to patch the recruitment portal led to the exposure of sensitive records belonging to over 5,000 bureau personnel.

Supporting Data: Infrastructure, Vulnerabilities, and Family Tapes

The operational footprint left behind by Khader and his associates reveals a trail of digital breadcrumbs that ultimately facilitated their unmasking.

The Oracle PeopleSoft Attack Vector

The technical catalyst for ShinyHunters’ 2026 resurgence was CVE-2026-35273. Despite Oracle issuing a rapid security patch, the group utilized sophisticated URL-encoding bypass techniques to circumvent Mandiant’s mitigation rules. This allowed them to harvest credentials and exfiltrate proprietary data from dozens of multinational corporations and government contractors. The breach of the FBI’s recruitment system—handled by a third-party contractor, Accenture—exposed highly sensitive dossiers, including unit specializations, medical histories, and psychiatric evaluations of over 5,000 personnel.

The Boeing and Jeppesen ForeFlight Extortion Nexus

According to intelligence sources familiar with the investigation, the FBI’s pursuit of Khader gained maximum urgency when ShinyHunters targeted Jeppesen ForeFlight, a digital aviation and navigation unit divested by aerospace giant Boeing in November 2025 in a $10.55 billion sale to Thoma Bravo. The data stolen from this unit posed direct operational safety and security risks, prompting intensive cross-border investigative cooperation.

This extortion target carries a layer of striking irony. Digital footprints uncovered during previous profiles of Khader revealed that his family’s shared computer had been compromised by infostealer malware. Data extracted from that infection showed Khader’s father—an employee of Royal Jordanian Airlines (a government-controlled airline operating a long-haul fleet built entirely by Boeing)—frequently used identical credentials across multiple corporate employee portals.

Despite deleting his primary social media profiles following outreach from security journalists, Khader’s public GitHub blog remained intact. Notably, a March 2026 post on his blog featured a deep-dive investigation doxing two Russian men alleged to be the core architects behind the Cl0p ransomware cartel, illustrating Khader’s fixation on challenging rival criminal groups.

Official Responses and Industry Fallout

As the fallout from the arrests ripples across the global cybersecurity landscape, corporate and official statements have underscored the gravity of the breaches.

• Boeing & Jeppesen ForeFlight: In a statement to researchers, Boeing acknowledged awareness of threat actor claims regarding Jeppesen ForeFlight data. Meanwhile, a Jeppesen ForeFlight spokesperson maintained a strong defensive posture: "Based on our investigation to date into this claim and proactive security posture, there was no impact to our operations or products."
• Neo Security: Pepijn van der Stap’s employer, Dutch cybersecurity firm Neo Security, was thrust into the spotlight following his dramatic arrest. Owner Benjamin Korper confirmed that forensic investigators and police searched their offices on September 15. Although an external audit found no evidence that Van der Stap had compromised Neo Security or its clients, the revelations regarding suspected contract murders have permanently severed his rehabilitation narrative. Prior to his first arrest in 2023, Van der Stap maintained a dual life as a software engineer for startup Hadrian and a volunteer for the Dutch Institute for Vulnerability Disclosure (DIVD) while simultaneously extorting enterprise networks.
• The Cybercrime Underground: Within encrypted Telegram chat servers, the reaction to Rey’s detention and Van der Stap’s arrest has been brutal. Rival groups, such as the monitoring channel "The Battle," have relentlessly mocked Khader, characterizing him as an inexperienced greenhorn who exploited a legendary brand name to negotiate deals for a 25% to 30% commission, ultimately causing over $200 million in cumulative damages while burning the ShinyHunters reputation to the ground.

Implications: The Death of the Brand and the Future of Extortion

The simultaneous neutralization of Pepijn van der Stap in Amsterdam and Saif Al-din Khader in Amman marks a watershed moment for modern cybercrime enforcement.

1. The Fragility of Cyber Franchises: The ShinyHunters saga demonstrates that while cybercrime brands can live on indefinitely through decentralized franchise models, they ultimately suffer from dilution. When teenagers and opportunistic freelancers inherit legacy monikers, their desperate need for clout—manifested through public memes, bragging on social media, and taunting federal agencies—destroys the operational obscurity that protected the syndicate’s early founders.
2. The Danger of Insider Infostealers: Khader’s downfall highlights the extreme risk posed by commodity infostealer malware within domestic settings. When family members reuse enterprise credentials on shared household machines, they inadvertently provide foreign and domestic threat actors with the keys to critical infrastructure, turning family networks into vectors for international espionage and extortion.
3. Escalating Geopolitical Consequences: Hacking federal recruitment portals to retaliate against public safety advisories is no longer viewed by law enforcement as mere digital vandalism. By touching sensitive military and aerospace assets—such as Boeing’s navigation subsidiaries—hacktivists and extortionists cross a threshold that transforms low-level data theft into a matter of national security, ensuring an unyielding, multi-agency manhunt.

Ultimately, the silence now settling over the darknet leak sites of ShinyHunters serves as a stark reminder: in the high-stakes game of digital extortion, playing the king ("Rey") is a surefire way to invite a checkmate from the global intelligence community.