The Rise and Fall of ‘Rey’: Inside the Reckless Reign of the ShinyHunters Franchise

In the shadowy ecosystem of global cybercrime, few names have garnered as much infamy—or generated as much controversy—as ShinyHunters. Once a disciplined, French-led syndicate responsible for the theft of billions of records, the group has recently morphed into something far more chaotic: a decentralized, franchise-style operation. At the center of this latest iteration was a teenager from Amman, Jordan, known by the handle "Rey."

Following his detention by Jordanian authorities, it has emerged that Rey is now cooperating with the Federal Bureau of Investigation (FBI). His arrest marks a pivotal moment in the ongoing battle against a group that, under his leadership, transformed from a calculated data-extortion machine into a reckless brand that dared to target the very agencies hunting them.

The Architect of Chaos: Who is ‘Rey’?

Identified by investigators as Saif Al-din Khader, "Rey" first surfaced on the digital radar as a prolific, albeit arrogant, operator. A profile developed by KrebsOnSecurity in November 2025 painted a picture of a young man deeply embedded in the ransomware-as-a-service (RaaS) community, openly admitting to affiliations with multiple threat groups.

Rey’s tenure as the de facto leader of the "new" ShinyHunters was defined by a departure from the group’s traditional methods. Where the original members focused on quiet, high-value data exfiltration, Rey utilized the brand to broadcast his presence, taunting law enforcement and rival ransomware groups alike. His recent attempt to extort a navigation and digital aviation unit formerly owned by the aerospace giant Boeing—Jeppesen ForeFlight—brought his activities to the attention of international intelligence agencies, adding a layer of national security urgency to his apprehension.

A Chronology of Escalation

The trajectory of the ShinyHunters brand under Rey’s control can be traced through a series of increasingly aggressive digital incursions:

• June 2026: ShinyHunters begins exploiting a zero-day vulnerability (CVE-2026-35273) in Oracle’s PeopleSoft platform. The campaign marks a shift toward mass-exploitation, targeting industries ranging from healthcare and government to higher education.
• September 15, 2026: Dutch police, in a tactical raid involving flash-bang grenades, arrest 24-year-old Pepijn van der Stap. The Dutch national, known by the alias "Umbreon," was suspected of being a key facilitator for the group.
• September 22, 2026: In a desperate bid to deflect blame, Rey posts memes to Twitter/X, mocking the FBI and the Cl0p ransomware group while simultaneously attempting to frame the incarcerated Van der Stap for his own exploits.
• Late September 2026: Following news of Van der Stap’s arrest and the subsequent public backlash, the ShinyHunters darknet portal abruptly goes offline.
• October 3, 2026: Sources confirm that Saif Al-din Khader (Rey) has been detained in Amman and is actively cooperating with the FBI.

The Mechanics of the Breach: Oracle PeopleSoft

The technical backbone of the recent ShinyHunters campaign relied heavily on the exploitation of Oracle PeopleSoft, a ubiquitous SaaS platform used for payroll, HR, and benefits management. By exploiting CVE-2026-35273, the group gained unauthorized entry into dozens of corporate and governmental networks.

Even when Mandiant and other security firms released firewall rules to mitigate the vulnerability, Rey and his cohorts employed advanced URL-encoding techniques to bypass these defenses. This persistence highlighted a dangerous evolution in the group’s capability, moving from amateurish "script kiddie" tactics to sophisticated evasion strategies that kept IT security teams across the globe on constant alert.

The Boeing Connection and Institutional Risk

Perhaps the most alarming chapter in the saga involves the attempted extortion of Jeppesen ForeFlight. The unit, which provides critical navigation data for the aviation industry, was a high-stakes target. Given that Rey’s father is reportedly an employee of Royal Jordanian Airlines—a carrier that relies heavily on Boeing aircraft—the incident raised immediate concerns regarding insider threat vectors and the potential for operational safety risks.

While Boeing has officially acknowledged the extortion attempts, they maintain that their primary operations were not compromised. Jeppesen ForeFlight issued a statement asserting that their "proactive security posture" protected their products and operations from any lasting impact. However, the optics of the situation—a teenager whose family reportedly used the same compromised credentials for airline portals as they did for personal accounts—underscore the fragility of modern corporate cybersecurity.

The Van der Stap Factor: From "Reformed" to Accused

The arrest of Pepijn van der Stap in the Netherlands has introduced a sinister new element to the investigation. Once a self-styled "offensive security lead" at the Dutch firm Neo Security, Van der Stap had successfully rebranded himself as a reformed hacker. That narrative shattered when Dutch media reported that he is now under investigation for allegedly ordering at least two murders abroad.

This revelation has forced a re-evaluation of how the cybersecurity industry vets "reformed" hackers. Experts argue that the industry’s hunger for talent has sometimes led to the uncritical acceptance of individuals whose past criminal history—and underlying motives—remained unchanged. Neo Security, having employed Van der Stap, is now conducting an internal audit, though they maintain that no evidence exists of him having compromised their clients during his tenure.

The "Franchise" Model: A New Era of Cybercrime

Security researchers have long noted that the "ShinyHunters" of 2026 are not the same group that dominated headlines in 2019. The current iteration operates less like a cohesive gang and more like a franchise—the "Dread Pirate Roberts" model.

In this structure, the brand name is a commodity. Freelance hackers and affiliates feed stolen credentials into the network, using the ShinyHunters name to lend credibility to their extortion demands in exchange for a percentage of the ransom. This model is inherently unstable, as evidenced by the internal infighting documented on Telegram channels like "The Battle."

Official Responses and Strategic Implications

The FBI’s involvement in the case has been proactive, if not always successful. The agency’s May 2026 flash notice warning victims not to pay ransoms inadvertently fueled the hackers’ desire for notoriety. By attacking the FBI’s recruitment portal—an act that led to the termination of an Accenture contractor for failing to patch the server—the group sought to prove their relevance and damage the agency’s credibility.

The implications of this breach were severe. Sensitive data on more than 5,000 FBI personnel, including psychiatric and medical records, were exposed. This level of compromise represents a massive intelligence failure and a significant blow to the agency’s security infrastructure.

Conclusion: The End of the Brand?

The detention of Rey and the ongoing investigation into Van der Stap mark the beginning of the end for this specific chapter of the ShinyHunters saga. However, the underlying vulnerability of global systems remains. As long as SaaS platforms like PeopleSoft are left unpatched and as long as there is a market for stolen credentials, the "franchise" model of cybercrime will persist.

For Rey, the "King" of the hackers, the reality of his situation is now defined by legal proceedings rather than Twitter memes. His cooperation with the FBI may offer him a measure of leniency, but the damage inflicted on corporate and government systems, and the trust eroded within the cybersecurity community, will take years to repair. The ShinyHunters name, once a symbol of technical prowess, has become a cautionary tale of how quickly a brand can be built, abused, and eventually discarded in the unforgiving world of digital warfare.