Saif Al-din Khader, a teenager from Amman, Jordan known online as “Rey,” was detained by Jordanian authorities and is reportedly cooperating with the FBI as the data theft syndicate ShinyHunters attempted to extort Jeppesen ForeFlight, a business unit divested last year by Boeing.
The Arrest in Amman and the Boeing Unit Extortion Target
The investigation into ShinyHunters intensified sharply when the group targeted Jeppesen ForeFlight. Boeing sold the subsidiary in November 2025 to the private equity firm Thoma Bravo for $10.55 billion. Boeing acknowledged the extortion attempts involving data stolen from the former subsidiary. A Boeing spokesperson stated, “We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight.” Responding to inquiries, a representative for Jeppesen ForeFlight issued an email note reporting that their operations experienced zero disruption.
Reuters cited three unnamed sources on October 3 detailing Khader’s detention and cooperation with the FBI. Rey’s father works for Royal Jordanian Airlines, which manufactures the fleet of planes used by the employer of Rey’s father. Security profiling conducted in November 2025 by KrebsOnSecurity revealed that password-stealing malware had infected the family’s shared computer. Logs showed the elder Khader using identical credentials across multiple employee portals for Royal Jordanian Airlines. Neither of the Khaders responded to inquiries sent prior to the publication of the September 28 report. Soon after those communications were sent, Rey began removing his multiple social media profiles, including the Twitter/X handle he previously utilized to mock the FBI, Cl0p, and other ShinyHunters victims.
Exploitation of Oracle PeopleSoft and the FBI Recruitment Breach
The operational engine behind the recent wave of extortion involved the mass exploitation of a zero-day vulnerability, designated CVE-2026-35273, within Oracle PeopleSoft. Organizations across higher education, technology, healthcare, agriculture, transportation, and government relied on the software-as-a-service platform for HR and payroll management. Mandiant and the Google Threat Intelligence Group released a report on September 25 confirming the mass exploitation. Initially, ShinyHunters attempted to breach the FBI’s proprietary PeopleSoft database in June, though those specific intrusions failed. When Mandiant issued web application firewall rules to block the activity, the threat actors employed URL-encoding workarounds to bypass the filters.
The campaign succeeded in breaching the FBI recruitment website, exposing sensitive records belonging to more than 5,000 bureau personnel, including unit assignments, specializations, and medical and psychiatric records. Reuters reported on October 5 that the FBI removed an Accenture contractor over the failure to patch the vulnerability. In response to the disclosures, the FBI published an advisory on May 15, 2026, warning organizations against paying ransoms. Dismissing the advisory as an unprofessional public relations move, ShinyHunters told The Register that their attacks “demonstrated our technical capabilities and directly refuted the misinformation disseminated by the FBI, journalists, and industry researchers.”
Following the September 15 arrest of 24-year-old Dutch cybercriminal Pepijn van der Stap by Dutch police, Rey seized control of the ShinyHunters brand. Using his Twitter/X account, Rey posted taunting memes featuring the Pokémon character Umbreon—the former hacker alias of Van der Stap—in an apparent attempt to frame the Dutchman. Investigations by Dutch outlet RTL revealed that Van der Stap faces separate allegations of trying to orchestrate at least two murders abroad. Van der Stap had recently described his role as an offensive security lead at Neo Security after serving part of a four-year sentence for data thefts yielding between €1.5 million and €2.7 million.
