Authorities in Jordan have reportedly detained Saif al-Din Khader, known online as ‘Rey’, a suspected member of the ShinyHunters extortion group. This development is crucial as Rey is allegedly cooperating with the FBI to identify other members of the group, according to sources cited by Reuters.
Detention and Cooperation with Authorities
Khader, detained on September 29, 2026, is assisting the FBI in its ongoing efforts to dismantle the ShinyHunters group. His involvement in various cybercriminal activities has been highlighted by independent security journalist Brian Krebs, who identified him as one of the administrators of the Scattered LAPSUS$ Hunters. Previously, Rey was linked with the Hellcat ransomware group and had assumed control of BreachForums.
Recent Arrests and Ongoing Investigation
This arrest follows the recent capture of a 24-year-old in Amsterdam, suspected to be Pepijn van der Stap, previously associated with Neo Security. Despite denials of any connection to ShinyHunters, this arrest has intensified the FBI’s investigation efforts. FBI Director Kash Patel emphasized the importance of these developments in progressing the case against the cybercriminal group.
In recent weeks, the ShinyHunters have gained notoriety for breaching the darknet site of Cl0p and exploiting vulnerabilities in the FBI’s job portal. Despite their activities, the group claims their intention is not financial gain but to challenge perceived false accusations by the FBI.
Impact and Future Outlook
According to Brett Leatherman, assistant director of the FBI’s cyber division, the ShinyHunters have allegedly extorted over 140 organizations, amassing $70 million in illicit payments. Leatherman has urged other group members to come forward, stressing that the anonymity they once relied on is no longer secure.
Cybersecurity firms Sekoia and Beazley Security have traced ShinyHunters’ roots back to groups like TheDarkOverlord and GnosticPlayers. Despite numerous arrests and indictments, the group has persisted, evolving into a resilient entity that continues to operate under a recognizable brand.
The ongoing investigation and recent arrests signify a significant stride in combating cybercrime, highlighting the importance of international cooperation in addressing these global threats.
