INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

FBI Arrests Suspected ShinyHunters Member Rey in Jordan Operation

| 2026-10-09 17:02 CRITICAL HIGH LAW ENFORCEMENT
JSON
Executive Summary
AI-generated
The FBI has arrested another suspected member of the ShinyHunters extortion group, believed to be involved in a recent breach of FBI systems. The arrest was announced by Director Kash Patel on Friday, October 9, and comes days after Hackread.com reported the detention in Jordan of suspected member Saif al-Din Khader, known online as "Rey". Multiple suspects have been arrested during an investigation into a September cyber incident allegedly involving ShinyHunters. The group is believed to be responsible for compromising over 140 organizations and obtaining at least $70 million in extortion payments since 2025. The FBI's investigation has also led to the detention of Pepijn van der Stap, known as "Umbreon", in Amsterdam on September 15, who was described by the agency as an alleged ShinyHunters leader.
Technical Mitigations AI-generated
• Use a secure version of the FBIJobs.gov system, such as Unc6240 (referenced in Source 3), to prevent similar breaches. • Block or hunt for indicators of ShinyHunters' data leak site, which remained online despite Khader's reported detention and continued availability of victim listings and download links. • Detect and patch vulnerabilities in systems compromised by ShinyHunters, such as those exploited by the group to obtain sensitive information belonging to current, former, and prospective FBI personnel.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 3 IoCs Create Free Account
hxxp://••••••••••••••••••••
2f•••••.exchange
fb•••••.html
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ShinyHuntersShinyHunters UmbreonUmbreon
Target & Sectors
NORTH_AMERICA NORTH_AMERICA BENELUX BENELUX mediamedia
Incident Timeline
‎2025/09/29
The FBI detained Rey, a suspect allegedly involved with ShinyHunters, reportedly assisting the agency in its investigation.
tactic Extortion
The FBI says ShinyHunters and its alleged co-conspirators have breached more than 140 organizations since last year and collected at least $70 million in extortion payments.
attribution FBI
The FBI says ShinyHunters and its alleged co-conspirators have breached more than 140 organizations since last year and collected at least $70 million in extortion payments.
threat_actor ShinyHunters
The FBI says ShinyHunters and its alleged co-conspirators have breached more than 140 organizations since last year and collected at least $70 million in extortion payments.
victims 140 organizations
The FBI says ShinyHunters and its alleged co-conspirators have breached more than 140 organizations since last year and collected at least $70 million in extortion payments.
financial $70 organizations
The FBI says ShinyHunters and its alleged co-conspirators have breached more than 140 organizations since last year and collected at least $70 million in extortion payments.
‎September 15
The 24-year-old Amsterdam suspect, identified as Pepijn van der Stap or Umbreon, was detained by Dutch police on September 15 under Dutch law.
organisation International Investigation Expands
International Investigation Expands Khader’s reported detention came two weeks after Dutch authorities arrested a 24-year-old man, Pepijn van der Stap, also known as Umbreon, in Amsterdam on September 15.
target_region Netherlands
International Investigation Expands Khader’s reported detention came two weeks after Dutch authorities arrested a 24-year-old man, Pepijn van der Stap, also known as Umbreon, in Amsterdam on September 15.
Dutch police detained the 24-year-old Amsterdam suspect on September 15 under Dutch law, with FBI investigators supporting the operation and pursuing leads.
"Following his arrest on September 15, a large amount of information was found on his laptop, including details about two murders that were to be committed abroad," the Dutch police announced today.
Dutch police said the suspect is a 24-year-old man from Amsterdam who was arrested on September 15 and is suspected of playing a role within ShinyHunters and participating in a criminal organization.
organisation Pepijn
International Investigation Expands Khader’s reported detention came two weeks after Dutch authorities arrested a 24-year-old man, Pepijn van der Stap, also known as Umbreon, in Amsterdam on September 15.
malware Umbreon
International Investigation Expands Khader’s reported detention came two weeks after Dutch authorities arrested a 24-year-old man, Pepijn van der Stap, also known as Umbreon, in Amsterdam on September 15.
attribution FBI
Dutch police detained the 24-year-old Amsterdam suspect on September 15 under Dutch law, with FBI investigators supporting the operation and pursuing leads.
threat_actor ShinyHunters
Dutch police said the suspect is a 24-year-old man from Amsterdam who was arrested on September 15 and is suspected of playing a role within ShinyHunters and participating in a criminal organization.
‎2026/09/28
The arrest of an alleged ShinyHunters member in the Netherlands was reportedly used as part of a piece on the FBI hack that led to the detention of another suspect, Rey, by the FBI in Jordan.
attribution FBI
Yesterday's scoop on the arrest of an alleged ShinyHunters m.... Yesterday's scoop on the arrest of an alleged ShinyHunters member in the Netherlands got picked up as part of a piece on the FBI hack that was the top story last night on the NYT homepage.
threat_actor ShinyHunters
Yesterday's scoop on the arrest of an alleged ShinyHunters m.... Yesterday's scoop on the arrest of an alleged ShinyHunters member in the Netherlands got picked up as part of a piece on the FBI hack that was the top story last night on the NYT homepage.
source_region Netherlands
Yesterday's scoop on the arrest of an alleged ShinyHunters m.... Yesterday's scoop on the arrest of an alleged ShinyHunters member in the Netherlands got picked up as part of a piece on the FBI hack that was the top story last night on the NYT homepage.
attribution NYT
Yesterday's scoop on the arrest of an alleged ShinyHunters m.... Yesterday's scoop on the arrest of an alleged ShinyHunters member in the Netherlands got picked up as part of a piece on the FBI hack that was the top story last night on the NYT homepage.
‎September 29
Reuters reported that Khader, a suspect in the ShinyHunters case, was detained on September 29.
organisation Reuters
Khader was detained on September 29, according to people familiar with the case cited by Reuters .
‎2026/09/29
The Dutch National Police, in collaboration with the FBI Cyber Division, arrested Rey, a suspect allegedly linked to ShinyHunters, on September 15.
target_region Netherlands
"Following his arrest on September 15, a large amount of information was found on his laptop, including details about two murders that were to be committed abroad," the Dutch police announced today.
"Today, our partners at the Dutch National Police announced the arrest of one of the alleged leaders of ShinyHunters, a group linked to cyberattacks in the United States, the Netherlands, and around the world," FBI Cyber Division Assistant Director Brett Leatherman said in a video released Tuesday.
threat_actor ShinyHunters
"Today, our partners at the Dutch National Police announced the arrest of one of the alleged leaders of ShinyHunters, a group linked to cyberattacks in the United States, the Netherlands, and around the world," FBI Cyber Division Assistant Director Brett Leatherman said in a video released Tuesday.
source_region United States
"Today, our partners at the Dutch National Police announced the arrest of one of the alleged leaders of ShinyHunters, a group linked to cyberattacks in the United States, the Netherlands, and around the world," FBI Cyber Division Assistant Director Brett Leatherman said in a video released Tuesday.
attribution the Dutch National Police
"Today, our partners at the Dutch National Police announced the arrest of one of the alleged leaders of ShinyHunters, a group linked to cyberattacks in the United States, the Netherlands, and around the world," FBI Cyber Division Assistant Director Brett Leatherman said in a video released Tuesday.
attribution FBI Cyber Division
"Today, our partners at the Dutch National Police announced the arrest of one of the alleged leaders of ShinyHunters, a group linked to cyberattacks in the United States, the Netherlands, and around the world," FBI Cyber Division Assistant Director Brett Leatherman said in a video released Tuesday.
‎October 1
Threat actors behind ShinyHunters published two entries on October 1, which were later removed.
‎October 3
Threat actors, identified as ShinyHunters, reportedly had a suspect detained by the FBI in Jordan on October 3.
‎2026/10/09
The FBI has arrested another suspected member of the ShinyHunters extortion group, believed to be involved in the recent breach of FBI systems.
threat_actor ShinyHunters
The FBI has arrested another suspected member of the ShinyHu.... The FBI has arrested another suspected member of the ShinyHunters extortion group believed to be involved in the recent breach of FBI systems, Director Kash Patel announced Friday.
The FBI has confirmed that multiple suspects have been arrested during its investigation into a September cyber incident allegedly involving the ShinyHunters extortion group.
The FBI described him as an alleged ShinyHunters leader and alleged that he and his co-conspirators had compromised more than 140 organizations and obtained at least $70 million in extortion payments since 2025.
FBI Director Kash Patel has announced the arrest of an alleged leader of ShinyHunters, the cyber-extortion group linked to attacks across the United States, the Netherlands, and other countries.
A suspected ShinyHunters hacking group member known online a.... A suspected ShinyHunters hacking group member known online as "Rey" has reportedly been detained in Jordan and is cooperating with the FBI to help locate other members of the extortion group.
The FBI is warning members of the ShinyHunters extortion group to turn themselves in after Dutch police arrested a man the bureau described as one of the group's alleged leaders.
Despite the sensitivity of the stolen information, ShinyHunters told BleepingComputer that the FBI attack was never financially motivated, an extortion attempt, or intended to publish the data.
FBI Confirms Multiple Arrests in ShinyHunters Investigation.
“The bureau continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects, and we will spare no resource in bringing each of the responsible individuals to justice,” an FBI spokesperson told The Register in an email on Monday.
The arrests come amid the bureau’s investigation into the September compromise of FBIJobs.gov , which ShinyHunters claimed involved the theft of sensitive information belonging to current, former and prospective FBI personnel.
FBI Warns Other Members Could Be Identified Brett Leatherman, assistant director of the FBI’s Cyber Division, previously warned that arrests and seized infrastructure could reveal who remains involved with ShinyHunters.
FBI and Dutch Police Arrested Alleged ShinyHunters Hackers Group Leader.
Although Dutch authorities did […] The post FBI and Dutch Police Arrested Alleged ShinyHunters Hackers Group Leader appeared first on Cyber Security News .
ShinyHunters hacker “Rey” was detained in Jordan and is reportedly cooperating with the FBI after the group claimed major FBI and corporate data breaches.
The FBI's warning comes shortly after ShinyHunters claimed responsibility for a massive data breach at the bureau itself , which the threat actors told BleepingComputer that the breach involved exploitation of an Oracle PeopleSoft zero-day.
FBI tells ShinyHunters members to turn themselves in after recent arrest.
ShinyHunters claimed to have stolen between two and three terabytes of data from FBI systems, including information connected to multiple internal services.
Instead, the threat actors claim it was done to dispute an FBI advisory that states ShinyHunters actors may exaggerate access to sensitive information, harass victims and their relatives, conduct swatting attacks, and falsely claim to possess compromising material.
The FBI is now taking a more public approach against the group, with Leatherman directly addressing the remaining ShinyHunters members in Tuesday's video.
ShinyHunters Leak Site Remains Online At the time of writing, ShinyHunters’ data leak site remained online, with its existing victim listings and download links still accessible.
ShinyHunters has denied that van der Stap was associated with the group.
ShinyHunters Suspect “Rey” Detained in Jordan, Reportedly Helping FBI.
ShinyHunters frequently targets corporate SSO accounts , third-party vendors , and cloud-based SaaS platforms, such as Salesforce and Snowflake , to steal sensitive data before extorting victims with threats to publish it.
" Dutch police also clarified Tuesday that the arrested suspect was not detained as part of the investigation into the ShinyHunters breach of Dutch telecom provider Odido.
victims 140 organizations
The FBI described him as an alleged ShinyHunters leader and alleged that he and his co-conspirators had compromised more than 140 organizations and obtained at least $70 million in extortion payments since 2025.
financial $70 organizations
The FBI described him as an alleged ShinyHunters leader and alleged that he and his co-conspirators had compromised more than 140 organizations and obtained at least $70 million in extortion payments since 2025.
organisation The Register
“The bureau continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects, and we will spare no resource in bringing each of the responsible individuals to justice,” an FBI spokesperson told The Register in an email on Monday.
organisation Cyber Division
FBI Warns Other Members Could Be Identified Brett Leatherman, assistant director of the FBI’s Cyber Division, previously warned that arrests and seized infrastructure could reveal who remains involved with ShinyHunters.
organisation Cyber Security News
Although Dutch authorities did […] The post FBI and Dutch Police Arrested Alleged ShinyHunters Hackers Group Leader appeared first on Cyber Security News .
data_breach 5,000 FBI personnel records
The group later provided a sample of about 5,000 FBI personnel records to media organizations, including BleepingComputer, to support its claims.
organisation Hackread.com
The confirmation came days after Hackread.com reported the detention in Jordan of suspected member Saif al-Din Khader, known online as “Rey.”
organisation Reuters
Reuters also reported that some of the exposed personnel were assigned to investigations involving China and Russia, raising concerns about the sensitivity of the information.
organisation NFL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
organisation CHANEL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Tactical Metrics
Metrics
victims
140
Organizations
The FBI described him as an alleged ShinyHunters leader and alleged that he and his co-conspirators had compromised more than 140 organizations and obtained at least $70 million in extortion payments since 2025.
The FBI says ShinyHunters and its alleged co-conspirators have breached more than 140 organizations since last year and collected at least $70 million in extortion payments.
Metrics
financial
70,000,000
Financial Impact / Stolen Funds
The FBI described him as an alleged ShinyHunters leader and alleged that he and his co-conspirators had compromised more than 140 organizations and obtained at least $70 million in extortion payments since 2025.
The FBI says ShinyHunters and its alleged co-conspirators have breached more than 140 organizations since last year and collected at least $70 million in extortion payments.
Metrics
data_breach
5,000
Fbi Personnel Records
The group later provided a sample of about 5,000 FBI personnel records to media organizations, including BleepingComputer, to support its claims.
Intelligence Sources
BleepingComputer 2026-09-29
Mastodon BleepingComputer 2026-10-09
Mastodon BleepingComputer 2026-10-03
AlienVault OTX 2026-10-03
AlienVault OTX 2026-09-29
Mastodon BrianKrebs 2026-09-29
HackRead 2026-10-06