ShinyHunters suspect Rey reportedly detained in Jordan

Detention in Jordan

Reuters, citing three people familiar with the matter, reports that Saif al-Din Khader was detained in Jordan on September 29, 2026. The suspected ShinyHunters member, known online as Rey and ReyXBF, is said to be cooperating with the FBI and law enforcement to identify other group members. One source described his cooperation as critical to ongoing efforts to arrest the hackers.

In a November 2025 report, independent security journalist Brian Krebs identified Khader as one of three administrators of Scattered LAPSUS$ Hunters, known as SLH or SLSH. Krebs described the group as an amalgamation of Scattered Spider, LAPSUS$ and ShinyHunters. He also reported that Khader administered the data leak website of ransomware group Hellcat and later took over the most recent incarnation of BreachForums in 2024. Khader had told Krebs that he had cooperated with law enforcement since at least June 2025.

A wider ShinyHunters investigation

The report followed the arrest of a 24-year-old Amsterdam man last week over his alleged involvement in ShinyHunters operations. Independent reports identified him as Pepijn van der Stap, a reformed hacker employed as offensive security lead at Neo Security. A ShinyHunters spokesperson denied any connection to van der Stap. FBI Director Kash Patel said the bureau was pursuing new leads and that more arrests were possible.

In recent weeks, ShinyHunters was accused of hijacking fellow cybercrime outfit Cl0p's darknet site through an unpatched Grav CMS vulnerability and hacking the FBI's apply.fbijobs[.]gov portal, taking around three terabytes of sensitive data. The group said it was not seeking a monetary payoff in the FBI case. It said the goal was to pressure the FBI to amend what it called false allegations and challenge claims about ShinyHunters' connections with The Com.

Brett Leatherman, assistant director of the FBI's cyber division, said the suspect and his co-conspirators had allegedly breached more than 140 organizations since the previous year and taken at least $70 million in extortion payments. He said they frequently target third-party vendors in cloud platforms, steal sensitive data and threaten victims with publication. Leatherman described van der Stap as an alleged ShinyHunters leader and urged other members to contact investigators.

Origins and structure

Sekoia and Beazley Security traced ShinyHunters to TheDarkOverlord and GnosticPlayers, two earlier groups focused on extortion and data leaks. They said the ShinyHunters brand appeared publicly around April or May 2020, evolving from a small crew trading stolen databases on RaidForums. Researchers Enzo Saez and Robert Venal described the operation as modular, with social engineers providing initial access, adjacent actors supporting recruitment and amplification, and participants monetizing stolen data under a shared brand.

Sources: Walled-Original