Key ShinyHunters Administrator Detained in Jordan as Law Enforcement Pressure Mounts

A core administrator behind the prolific ShinyHunters extortion network has been taken into custody, marking another major law enforcement blow against one of the cybercrime landscape’s most resilient threat groups. Saif al-Din Khader, known online as “Rey” and “ReyXBF,” was detained by Jordanian authorities on September 29, 2026, and is actively cooperating with the U.S. Federal Bureau of Investigation (FBI) to unmask other operatives within the collective.

The detention comes hot on the heels of another high-profile arrest in Amsterdam, where Dutch authorities apprehended 24-year-old Pepijn van der Stap—a reformed hacker serving as the offensive security lead for Dutch firm Neo Security—whom FBI leadership identified as an alleged key figure in ShinyHunters operations. Together, the law enforcement actions represent a coordinated push to dismantle a threat actor responsible for extorting more than $70 million from over 140 organizations since last year alone.

A Modular Lineage of Extortion

ShinyHunters is not a traditional centralized ransomware syndicate, but rather an evolving brand identity and operational methodology. Security research from Sekoia and Beazley Security traces the group’s roots back to earlier breach-and-extortion crews including TheDarkOverlord and GnosticPlayers. Appearing under the ShinyHunters moniker around April or May 2020 on platforms like RaidForums, the threat actor gradually transformed from a small group trading stolen databases into a decentralized network absorbing repeated arrests, forum seizures, and indictments without going offline.

Over time, ShinyHunters merged operational channels with other notorious threat groups, giving rise to “Scattered LAPSUS$ Hunters” (SLH)—an amalgamation combining elements of Scattered Spider, LAPSUS$, and ShinyHunters. In addition to his role in SLH, Khader previously served as an administrator for the Hellcat ransomware group’s data leak site in late 2024 and took control of a recent incarnation of BreachForums.

The group’s operational resilience stems from its modular division of labor:

• Initial Access & Social Engineering: Leveraging tactics closely affiliated with “The Com”—a loose network specializing in SIM swapping, help-desk social engineering, spear-phishing, and vishing to bypass multi-factor authentication (MFA).
• Vendor & Cloud Exploitation: Targeting third-party software supply chains, cloud hosted environments, and single sign-on (SSO) infrastructure to harvest elevated credentials.
• Exfiltration & Monetization: Stealing large volumes of sensitive corporate or customer data and demanding extortion payments under a widely recognized brand name, frequently leveraging custom leak sites or compromised darknet infrastructure.

Escalating Campaign and High-Profile Targets

The arrests follow a series of aggressive campaigns designed to draw publicity and exert pressure on victims and law enforcement. In recent weeks, ShinyHunters hijacked the darknet leak site of rival ransomware crew Cl0p by exploiting an unpatched vulnerability in Grav CMS—a flat-file content management system frequently deployed for lightweight sites.

More critically, the group breached the FBI’s applicant web portal (apply.fbijobs[.]gov), exfiltrating approximately three terabytes of sensitive data. Rather than seeking a standard extortion payout for the FBI breach, the group publicly claimed the intrusion was intended to force the bureau to retract statements linking them to violent criminal networks associated with The Com.

Despite these publicity maneuvers, the underlying technical playbooks rely heavily on exploiting weak initial access controls, unpatched web-facing application vulnerabilities (such as arbitrary file upload or remote code execution flaws in CMS platforms), and compromised third-party cloud integrations.

Impact and Blast Radius

When ShinyHunters compromises an organization, the blast radius typically extends far beyond the initial entry point. By targeting cloud-hosted environments and third-party SaaS vendors, the group frequently accesses centralized data repositories containing personally identifiable information (PII), sensitive database backups, and intellectual property.

For victims, the operational impact includes direct financial extortion, severe regulatory non-compliance exposure, public dumping of stolen datasets, and customer trust degradation. The group’s tendency to compromise third-party supply chain partners means that even organizations with robust perimeter security remain vulnerable if their trusted vendor credentials or cloud APIs are exposed.

Tactical Guidance for Security Teams

Because ShinyHunters relies primarily on social engineering, credential theft, and web application exploitation rather than proprietary malware payloads, defensive efforts must focus on identity security and public-facing asset management:

• Harden Identity Controls: Implement FIDO2/WebAuthn-based phishing-resistant MFA across all identity providers. Secure help desk identity verification procedures to prevent social engineering attacks targeting password resets or MFA device re-registration.
• Audit Third-Party Cloud Access: Review cross-account IAM roles, API keys, and third-party vendor access permissions within cloud environments (e.g., AWS, Snowflake, Azure). Enforce least-privilege access policies and rotate dormant API tokens.
• Patch Content Management Systems: Inspect all external-facing web applications running flat-file content management systems, specifically Grav CMS instances. Ensure Grav CMS installations are updated to the latest stable version and verify that web server execution permissions prevent script execution inside upload directories.
• Monitor Session Token Abuse: Implement detections for anomalous session cookie usage, impossible travel alerts, and concurrent logins originating from residential proxy networks.