Suspected ShinyHunters Member Reportedly Detained in Jordan, Cooperating With FBI
Summary
A suspected ShinyHunters member known as Rey was reportedly detained in Jordan on September 29, 2026, and is said to be helping the FBI identify other group members.
Key points
- Rey, also known as Saif al-Din Khader, was reportedly detained in Jordan on September 29, 2026.
- Sources cited by Reuters say he is cooperating with the FBI and law enforcement to identify other ShinyHunters members.
- Rey was previously linked to Scattered LAPSUS$ Hunters, Hellcat, and BreachForums.
- Recent ShinyHunters activity includes hijacking Cl0p’s darknet site and breaching the FBI’s apply[.]fbijobs[.]gov portal.
- The FBI says the group and its alleged co-conspirators have breached more than 140 organizations and received at least $70 million in extortion payments.
- Researchers describe ShinyHunters as a resilient brand whose roots trace to TheDarkOverlord and GnosticPlayers.
Article Details
- Event Type
- Reported detention of a suspected ShinyHunters member in Jordan, alongside ongoing arrests and investigations into the group.
- Impact
- Rey is reportedly cooperating with the FBI to identify other ShinyHunters members. The article also reports that the group breached the FBI's apply.fbijobs.gov portal and stole around three terabytes of sensitive data, and that it has allegedly breached more than 140 organizations and received at least $70 million in extortion payments.
People
Brett LeathermanAssistant director of the FBI's cyber division; described alleged ShinyHunters activity and urged members to cooperate.Brian KrebsSecurity journalist who reported on Rey's alleged roles in Scattered LAPSUS$ Hunters, Hellcat, and BreachForums.Enzo SaezResearcher who co-authored a report tracing ShinyHunters' origins and evolution.Kash PatelFBI director who said FBI teams were pursuing leads and that more arrests were possible.Pepijn van der StapIdentified in independent reports as the Amsterdam man arrested in connection with ShinyHunters; the article says a ShinyHunters spokesperson denied connections with him.Robert (Bobby) VenalResearcher who co-authored a report tracing ShinyHunters' origins and evolution.Saif al-Din KhaderReportedly detained in Jordan and cooperating with law enforcement; identified in the article as the person known by the aliases Rey and ReyXBF.
Threat Actors
Cl0pCybercriminal outfit whose darknet website ShinyHunters reportedly hijacked.GnosticPlayersHacking group identified by researchers as one of the groups from which ShinyHunters' lineage traces back.HellcatRansomware group for which Rey reportedly administered a data leak website.LAPSUS$Group identified in the article as one component of the amalgamation called Scattered LAPSUS$ Hunters.ReyOnline alias of Saif al-Din Khader, a suspected ShinyHunters member reportedly detained in Jordan.ReyXBFOnline alias of Saif al-Din Khader, also known as Rey; reportedly associated with ShinyHunters.Scattered LAPSUS$ HuntersGroup that Brian Krebs reported Rey administered; described as an amalgamation of Scattered Spider, LAPSUS$, and ShinyHunters.Scattered SpiderGroup identified in the article as one component of the amalgamation called Scattered LAPSUS$ Hunters.ShinyHuntersDigital extortion group implicated in breaches, data theft, and extortion; the FBI said it had allegedly breached more than 140 organizations.The ComDescribed in the article as a loose-knit cybercrime collective associated with social engineering, phishing, SIM swapping, extortion, and other crimes.TheDarkOverlordHacking group identified by researchers as one of the groups from which ShinyHunters' lineage traces back.