Suspected ShinyHunters Member Reportedly Detained in Jordan

A suspected ShinyHunters member known online as “Rey” has reportedly been detained in Jordan and is cooperating with the FBI to help identify other members of the extortion group, according to Reuters, citing sources familiar with the case.

Jordanian authorities detained Rey, identified as Saif al-Din Khader, this week; two sources told Reuters he was taken into custody on Tuesday. Sources said Khader is helping the FBI and international law enforcement agencies locate other group members. One source said he is showing investigators his electronic devices and digital communications.

The reported detention comes amid an FBI investigation into claims that ShinyHunters breached bureau systems. In September, the group told BleepingComputer it had used an alleged Oracle PeopleSoft zero-day vulnerability to access FBI systems and move into FBI-managed AWS GovCloud systems. The group claimed it stole between 2TB and 3TB of data. BleepingComputer said it had not independently verified the alleged vulnerability, the lateral movement, or the claimed volume of stolen data. The FBI confirmed it was investigating claims of unauthorized activity, but did not confirm data theft.

On Tuesday, ShinyHunters-linked messaging and leak-site activity was disrupted, and the group’s main representative stopped responding to media. It is unclear whether these events are connected to Khader’s reported detention. A new ShinyHunters leak site appeared on Thursday, suggesting others may still be operating the extortion operation. The group did not respond to BleepingComputer’s inquiry about Rey.