Alleged ShinyHunters Leader Arrested in Jordan
An individual believed to be the leader of the extortion group ShinyHunters has been arrested in Amman, Jordan, and is currently assisting the FBI with identifying other members.
Radwan AbdulhadiEditor and technology writer
Arrest of Alleged ShinyHunters Leader in Jordan
An individual believed to be the leader of the extortion group ShinyHunters has reportedly been arrested in Jordan and is cooperating with the FBI. According to reports, the suspect is Saif al-Din Khader, a teenage cybercriminal from Amman known by the online alias Rey. Further details regarding the exact location of his detention remain unclear, but it has been noted that he is helping the FBI identify and locate other members of the group.
In addition to his alleged leadership role within ShinyHunters, Khader is also recognized as a member of the Scattered Lapsus$ Hunters group. His detention marks a notable development in ongoing international law enforcement efforts targeting high-profile extortion rings.
The FBI Jobs Site Hack and Data Claims
The arrest in Jordan took place shortly after the extortion group carried out a cyberattack against the FBI. The attackers successfully hacked and defaced the FBI's jobs site, publicly boasting about stealing between 2 and 3 terabytes of data during the intrusion.
Following the website defacement, ShinyHunters sent a sample list containing 5,000 FBI employees to various media outlets. The cybercriminal group asserted that they were in possession of comprehensive personal and health information pertaining to all current and former personnel of the agency.
Connection to Previous Dutch Police Arrest
The international dragnet surrounding ShinyHunters has spanned multiple jurisdictions. Law enforcement authorities previously announced the arrest of a 24-year-old man from Amsterdam as part of the overarching investigation into the extortion collective.
The FBI subsequently confirmed the arrest, noting that the individual detained in the Netherlands was implicated in hacking over 140 organizations and collecting at least $70 million in total extortion payments.
Attribution and Investigation Details
While Dutch and American law enforcement agencies initially withheld the identity of the suspect arrested in Amsterdam, independent investigative reports suggested he is Pepijn van der Stap. Van der Stap had been previously convicted in 2023 for hacking and extorting multiple organizations and was serving a period of supervised release following a three-year prison sentence.
Investigative journalism indicated that Khader allegedly tried to frame van der Stap for the recent FBI cyberattack by incorporating a defacement image featuring the Pokémon character Umbreon, a nickname van der Stap had previously utilized during his own extortion activities.
Ongoing Law Enforcement Actions
Federal law enforcement agencies have emphasized that the multi-jurisdictional investigation into ShinyHunters remains very active. Officials have indicated that international cooperation continues to yield vital leads as authorities pursue remaining suspects.
Highlighting the ongoing nature of the crackdown on the extortion group, FBI Director Kash Patel addressed the public regarding the status of the investigation on social media, indicating that additional enforcement actions are anticipated.
Sources
- SecurityWeekAlleged ShinyHunters Leader Arrested in Jordan
Continue chronologically
Related stories
Suspected ShinyHunters Hacker Rey Detained in Jordan
A suspected member of the ShinyHunters hacking group known as Rey has reportedly been detained in Jordan and is cooperating with the FBI.
FBI Director Claims 605% Increase in Agency AI Usage
FBI Director Kash Patel reports a significant spike in AI adoption, citing increased efficiency in data triage and ongoing collaborations with tech leaders.
US Arrests Tech CEO Over $300M Nvidia Chip Smuggling Scheme
Federal authorities have arrested California tech CEO Greg Lui for allegedly smuggling over $300 million in restricted Nvidia chips to China.
BigCommerce Warns Merchants of Data Breach via Ribon Apps
BigCommerce alerts merchants to a data breach after attackers compromised third-party Ribon app credentials and injected malicious scripts into online stores.
