ShinyHunters Hacker "Rey" Detained in Jordan, Cooperating With FBI

Law enforcement pressure on the prolific cybercrime syndicate ShinyHunters reached a major turning point following the detention of Saif al-Din Khader, a key operator known online as “Rey.” Detained in Jordan, Khader is actively cooperating with the FBI and international authorities, walking investigators through his digital communications, electronic devices, and infrastructure to help identify co-conspirators across the extortion network.

This detention comes amidst an aggressive campaign by global law enforcement targeting ShinyHunters, following the group’s high-profile cyberattack against the FBI itself. FBI Cyber Division Assistant Director Brett Leatherman recently issued an explicit warning to remaining group members, noting that ongoing arrests and seized infrastructure are providing investigators with the intelligence needed to locate surviving operators.

Infrastructure Shuts Down as “Rey” Aids FBI Investigation

Khader’s detention in Jordan coincides with widespread operational disruption within the ShinyHunters group. Following his arrest, a main affiliate account abruptly closed, the primary ShinyHunters extortion site was pulled offline, and key representatives stopped responding to external media queries. While the sudden darknet blackout suggested internal panic, a replacement data leak site appeared shortly thereafter, demonstrating that remaining members are attempting to maintain the extortion operation.

The arrest of Khader follows the September 15 capture of 24-year-old Pepijn van der Stap (known online as “Umbreon”) in Amsterdam by Dutch police. Together, the loss of van der Stap and Khader represents a substantial blow to the group’s leadership and operational security.

Who Is “Rey” and What Attacks Is He Tied To?

Saif al-Din Khader, operating under the alias “Rey,” has been a central figure in multiple high-profile intrusion and extortion campaigns over the last two years. Security journalist Brian Krebs outed Khader in November 2025 after linking his online persona to infostealer logs and engaging in direct communications over Signal, where Khader admitted to speaking with law enforcement.

Khader’s threat activity spans several allied cybercrime collectives, including the HellCat ransomware group, ShinyHunters, and “Scattered Lapsus$ Hunters”—a coalition formed by veteran operators from Scattered Spider, Lapsus$, and ShinyHunters. His record of targeted intrusions includes:

• Telefónica (January 2025): Khader was one of four threat actors who compromised Telefónica’s internal Jira ticketing system, exfiltrating approximately 2.3GB of internal documentation and ticket data.
• Orange Romania (February 2025): Operating independently under the HellCat moniker, Khader breached Orange Romania and leaked 6.5GB of internal data.
• Jaguar Land Rover (March & September 2025): Khader leaked corporate data, employee records, and developer logs from JLR in March 2025. Later, in September 2025, the Scattered Lapsus$ Hunters group launched a major cyberattack against JLR, forcing the automaker to halt vehicle production for weeks and causing over $220 million in losses.
• FBI PeopleSoft Breach (September 2025): ShinyHunters breached FBI systems by leveraging an alleged zero-day vulnerability in Oracle PeopleSoft. The threat actors subsequently moved laterally into FBI-managed AWS GovCloud environments, claiming the exfiltration of 2TB to 3TB of data, including medical, psychiatric, and background information on FBI employees and job applicants.
• Instructure Canvas (May 2025): ShinyHunters launched a major data theft attack against the educational platform, causing severe outages before reaching an agreement with the company to prevent public data exposure.

TTPs: SaaS Token Hijacking and Edge Application Zero-Days

ShinyHunters and its associated factions represent a shift away from traditional file-encrypting ransomware toward cloud-native data exfiltration and pure extortion. Their campaigns target software-as-a-service (SaaS) platforms, developer toolchains, and enterprise cloud infrastructure.

The group’s initial access vectors frequently rely on targeting third-party service integration providers, abusing exposed API keys, and leveraging stolen session cookies or OAuth authentication tokens obtained via infostealer logs. Once inside enterprise platforms such as Salesforce, Snowflake, or AWS GovCloud, the attackers harvest sensitive customer databases and operational data without triggering traditional endpoint detections.

When targeting enterprise infrastructure directly, ShinyHunters actors focus heavily on edge applications and internal operational platforms like Atlassian Jira and Oracle PeopleSoft enterprise resource planning (ERP) suites. Zero-day exploits or unpatched remote code execution vulnerabilities in these platforms allow the group to establish a foothold, harvest lateral credentials, and expand access into connected cloud backup locations and AWS environments.

Mitigating SaaS Extortion and Integration Risks

While law enforcement continues to dismantle the core ShinyHunters membership, the release of a new extortion site confirms the threat remains active. Organizations managing complex SaaS ecosystems or web-facing enterprise software must harden their identity controls and integration security:

• Audit SaaS OAuth Tokens and Third-Party Apps: Frequently review and restrict third-party integration permissions in Salesforce, ServiceNow, and AWS environments. Revoke stale OAuth tokens, enforce short session lifetimes, and restrict third-party API keys to minimal required scopes.
• Harden Enterprise Middleware: Ensure edge systems and internal management suites—specifically Oracle PeopleSoft and self-hosted Atlassian Jira instances—are shielded behind enterprise zero-trust network access (ZTNA) or VPNs rather than exposed directly to the public internet.
• Monitor Session Hijacking Indicators: Deploy identity threat detection and response (ITDR) solutions capable of flagging anomalous session cookie usage, rapid geographic login changes, and unexpected administrative privileges granted within Telegram-coordinated intrusion flows.