Back Securityweek Alleged ShinyHunters Leader Arrested in Jordan
An individual believed to be the leader of the extortion group ShinyHunters was reportedly arrested in Jordan and is cooperating with the FBI.
The suspect, Saif al-Din Khader, known as Rey, a teenage cybercriminal from Amman, is helping the FBI identify other ShinyHunters members, Reuters reports .
Khader is also a known member of the Scattered Lapsus$ Hunters group. It is unclear where he is detained.
The arrest was made shortly after the extortion group hacked and defaced the FBI’s jobs site , FBIJobs.gov, boasting stealing 2-3 terabytes of data.
ShinyHunters sent a sample list of 5,000 FBI employees to the media, claiming to be in possession of the personal and health information of all current and former FBI employees.
Last week, the Dutch police announced the arrest of a 24-year-old man from Amsterdam as part of the FBI’s investigation into ShinyHunters.
The FBI later confirmed the arrest , saying the individual was involved in the hacking of more than 140 organizations, as well as in collecting at least $70 million in extortion payments.
While the Dutch police and the FBI refrained from revealing the suspect’s identity, independent reports have suggested he is Pepijn van der Stap, who was convicted in 2023 for hacking and extorting numerous organizations and was on supervised release after serving three years in prison.
Khader apparently pinned the recent FBI hack on van der Stap by placing a defacement image featuring the Pokémon character Umbreon. Van der Stap used the nickname Umbreon in his extortion activities, investigative journalist Brian Krebs reported.
The FBI last week said it was actively working with partners to pursue additional leads in its ShinyHunters investigation.
“More arrests are on the table,” FBI Director Kash Patel posted on X.
Related: Crypto Scammers Hijack Microsoft’s Official X Account
Related: In Rare Move, Alleged Iranian State Hacker Extradited to US
Related: Police Shut Down KillSec Ransomware, Identify Alleged Teen Leader
Related: Treasury Blacklists Most-Wanted ATM Malware Developer and His Network
Ionut Arghire is an international correspondent for SecurityWeek.
More from Ionut Arghire
Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks
Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action
Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure
Zammad Zero-Days Exploited in AI-Powered DIVD Hack
500,000 Active Credentials Left Exposed on GitHub
Cisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability
WatchGuard Patches Critical Fireware OS Code Injection Vulnerability
Chrome, Firefox Updates Patch Over 100 Vulnerabilities
Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier
Trump Names National Intelligence Director Jay Clayton to Lead a New Federal AI Task Force
doxx.net Raises $38 Million to Prevent AI Agent-on-the-Internet Misadventures
Fortra Patches Critical Vulnerabilities in BoKS
In Other News: $15K iCloud Spoofing Bugs, AI Policy Experts Phished, Adblocker Spies on AI Chats
macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor
Crypto Scammers Hijack Microsoft’s Official X Account
In Rare Move, Alleged Iranian State Hacker Extradited to US
Flipboard Whatsapp Whatsapp Email
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
