Alleged ShinyHunters Leader Arrested in Jordan

Summary

An individual identified as Saif al-Din Khader, known as Rey and believed to be the leader of the ShinyHunters extortion group, has been arrested in Jordan. He is reportedly cooperating with the FBI to identify other group members. This arrest follows a recent hack of the FBI's jobs site, where ShinyHunters claimed to steal terabytes of data and personal information of FBI employees. The FBI also confirmed a separate arrest in Amsterdam related to the group's activities, involving over 140 organizations and $70 million in extortion.

Full text

An individual believed to be the leader of the extortion group ShinyHunters was reportedly arrested in Jordan and is cooperating with the FBI. The suspect, Saif ‌al-Din Khader, known as Rey, a teenage cybercriminal from Amman, is helping the FBI identify other ShinyHunters members, Reuters reports. Khader is also a known member of the Scattered Lapsus$ Hunters group. It is unclear where he is detained. The arrest was made shortly after the extortion group hacked and defaced the FBI’s jobs site, FBIJobs.gov, boasting about stealing 2-3 terabytes of data. ShinyHunters sent a sample list of 5,000 FBI employees to the media, claiming to be in possession of the personal and health information of all current and former FBI employees. Last week, the Dutch police announced the arrest of a 24-year-old man from Amsterdam as part of the FBI’s investigation into ShinyHunters.Advertisement. Scroll to continue reading. The FBI later confirmed the arrest, saying the individual was involved in the hacking of more than 140 organizations, as well as in collecting at least $70 million in extortion payments. While the Dutch police and the FBI refrained from revealing the suspect’s identity, independent reports have suggested he is Pepijn van der Stap, who was convicted in 2023 for hacking and extorting numerous organizations and was on supervised release after serving three years in prison. Khader apparently pinned the recent FBI hack on van der Stap by placing a defacement image featuring the Pokémon character Umbreon. Van der Stap used the nickname Umbreon in his extortion activities, investigative journalist Brian Krebs reported. The FBI last week said it was actively working with partners to pursue additional leads in its ShinyHunters investigation. “More arrests are on the table,” FBI Director Kash Patel posted on X. Related: Crypto Scammers Hijack Microsoft’s Official X Account Related: In Rare Move, Alleged Iranian State Hacker Extradited to US Related: Police Shut Down KillSec Ransomware, Identify Alleged Teen Leader Related: Treasury Blacklists Most-Wanted ATM Malware Developer and His Network Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Warlock Expands SharePoint Exploitation in Critical Infrastructure AttacksExploited Fortinet FortiMail Zero-Day Calls for Urgent ActionZimbra Vulnerability Exploited in the Wild Prior to Public DisclosureZammad Zero-Days Exploited in AI-Powered DIVD Hack500,000 Active Credentials Left Exposed on GitHubCisco Patches Exploited Catalyst SD-WAN Zero-Day VulnerabilityWatchGuard Patches Critical Fireware OS Code Injection VulnerabilityChrome, Firefox Updates Patch Over 100 Vulnerabilities Latest News Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days EarlierTrump Names National Intelligence Director Jay Clayton to Lead a New Federal AI Task Forcedoxx.net Raises $38 Million to Prevent AI Agent-on-the-Internet MisadventuresFortra Patches Critical Vulnerabilities in BoKSIn Other News: $15K iCloud Spoofing Bugs, AI Policy Experts Phished, Adblocker Spies on AI ChatsmacOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD BackdoorCrypto Scammers Hijack Microsoft’s Official X AccountIn Rare Move, Alleged Iranian State Hacker Extradited to US Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Securing AI Agents, MCPs, and AI Automations October 7, 2026 Learn how to address potential risks and not restrict AI adoption in your organization. See what a centralized AI gateway is and how it works in practice. Register Virtual Event: Zero Trust & Identity Strategies Summit 2026 October 14, 2026 Join as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction. Register People on the MoveChip Wentz has been appointed as SVP & CISO at Keurig Dr Pepper Inc.Lumen Technologies has named Kim Keever as CSO.Quantum Secure Encryption Corp. has appointed Joseph Hall as CIO.More People On The MoveExpert Insights AI Has Changed Attack Speed, Not Security Fundamentals As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals. (Joshua Goldfarb) Four Cyber Threats Harboring Big Plans for the Future - AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations. (Steve Durbin) Begin at the End: How to Enable Agentic Remediation Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk. (Nadir Izrael) “We Think the Security Control Is Working” Is No Longer Good Enough Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar) This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• domain — FBIJobs.gov

Entities