Jordanian Authorities Detain Suspected ShinyHunters Leader
On October 3, Jordanian authorities detained Saif Al-din Khader, a teenager from Amman suspected of leading the data theft and extortion group ShinyHunters. Khader, who operates under the hacker alias 'Rey,' is reportedly cooperating with the FBI to identify other members of the cybercriminal network. The detention occurred while ShinyHunters was actively attempting to extort a business unit recently divested by Boeing.
Extortion Target: Jeppesen ForeFlight
The targeted unit is Jeppesen ForeFlight, a navigation and digital aviation business that Boeing sold in November 2025 to private equity firm Thoma Bravo for $10.55 billion. According to sources familiar with the investigation, ShinyHunters had allegedly stolen sensitive data from Jeppesen ForeFlight and was using it to extort the company. Boeing confirmed awareness of the claims and stated it is reviewing the matter with the Jeppesen ForeFlight team. A spokesperson for Jeppesen ForeFlight said their investigation found no impact on operations or products.
Connection to Royal Jordanian Airlines
Khader’s alleged involvement is notable due to his father’s employment with Royal Jordanian Airlines, which is largely controlled by the Jordanian government and operates a long-haul fleet of Boeing-built aircraft. While Khader claimed on Telegram in early 2025 that his father is an airline pilot, this could not be independently confirmed. However, a November 2025 profile by KrebsOnSecurity noted that malware on the family’s shared computer showed his father using identical credentials to access multiple Royal Jordanian Airlines employee portals.
ShinyHunters Exploited Oracle PeopleSoft Zero-Day
ShinyHunters gained access to numerous victims, including the FBI, by exploiting a zero-day vulnerability (CVE-2026-35273) in Oracle’s PeopleSoft software-as-a-service platform. The group began exploiting this flaw in June 2026, before Oracle issued a patch. Mandiant released temporary web application firewall rules to help organizations defend against attacks while awaiting updates.
Although ShinyHunters initially told BleepingComputer that their goal was to breach the FBI’s PeopleSoft database, those attempts were unsuccessful. Later, the group used a URL-encoding technique to bypass Mandiant’s firewall rules and successfully exploited the vulnerability across dozens of systems in sectors including higher education, technology, healthcare, agriculture, transportation, and government.
FBI Data Exposure and Contractor Removal
On October 5, Reuters reported that the FBI removed a contractor at Accenture for failing to patch the FBI recruitment website, which had been hacked by ShinyHunters. The breach exposed sensitive data on over 5,000 FBI personnel, including job units, specializations, and medical and psychiatric records.
Rey’s Role and Online Activities
Following the September 15 arrest of Dutch cybercriminal Pepijn van der Stap (known as 'Umbreon') in the Netherlands, Khader assumed public control of the ShinyHunters brand. He taunted both the FBI and the ransomware group Cl0p via memes on Twitter/X, including images of van der Stap’s 'Umbreon' avatar in an apparent attempt to frame him for the attacks.
Hours after KrebsOnSecurity emailed Khader’s father for comment on September 28, Khader began deleting his social media accounts. However, his cybersecurity blog on GitHub remained active, featuring a March 2026 post that doxxed two Russian men as the core operators behind the Cl0p ransomware group.
ShinyHunters as a Franchise Model
Experts describe ShinyHunters as having evolved into a franchise model, where the name is used by various affiliates rather than a fixed core group. Many original members, primarily French citizens, have been arrested or imprisoned. Current operators are said to be freelancers who supply stolen SaaS credentials in exchange for a share of ransom payments.
After van der Stap’s arrest, a Telegram chat allegedly operated by Khader erupted with ridicule as he backed down from threats against the FBI and Cl0p. Meanwhile, a Telegram channel called 'The Battle' has been actively doxxing and mocking Khader, accusing him of exploiting the ShinyHunters name after its original members were dismantled.
Source: Krebs on Security