ShinyHunters Suspect ‘Rey’ Reportedly Detained in Jordan, Cooperating With FBI

A suspected member of the ShinyHunters cybercrime group, known online as “Rey” and “ReyXBF,” has reportedly been detained in Jordan and is said to be cooperating with the U.S. Federal Bureau of Investigation (FBI) as authorities work to identify other individuals linked to the hacking operation.

According to a Reuters report citing people familiar with the matter, Rey, whose reported real name is Saif al-Din Khader, was taken into custody on September 29, 2026.

Sources reportedly said Khader has been providing information to U.S. investigators and other law enforcement authorities, potentially giving investigators new leads into the structure and membership of the ShinyHunters operation.

One source described his cooperation as important to efforts aimed at identifying and arresting additional suspects associated with the group.

Khader is not a new name in the cybercrime ecosystem. He has previously been linked to several prominent underground hacking communities and data-leak operations.

Independent cybersecurity journalist Brian Krebs previously identified Rey as one of the administrators of Scattered LAPSUS$ Hunters, also referred to as SLH or SLSH. The operation has been described as an alliance or convergence involving individuals associated with Scattered Spider, LAPSUS$, and ShinyHunters.

Khader was also previously associated with the Hellcat ransomware group, where he reportedly served as an administrator of its data-leak platform. In 2024, he was said to have taken over the administration of a later version of BreachForums, a notorious cybercrime forum used by hackers to trade stolen information.

Reports have also indicated that Khader had been communicating with law enforcement before his reported detention, with his cooperation said to have started at least as early as June 2025.

The reported detention comes amid increasing pressure on ShinyHunters and individuals allegedly connected to its operations.

In September, Dutch authorities arrested a 24-year-old man in Amsterdam over alleged involvement in cybercrime activities associated with the group. Although authorities did not immediately publicly disclose his identity, independent reports identified the suspect as Pepijn van der Stap, a former hacker who had reportedly moved into legitimate cybersecurity work as an offensive security lead at Dutch company Neo Security.

ShinyHunters subsequently denied having any connection with van der Stap.

The arrest nevertheless prompted a strong response from FBI Director Kash Patel, who said the bureau was working with law enforcement partners to develop additional leads from the investigation.

Patel later indicated that investigators were pursuing further information and that additional arrests could follow.

The investigation comes as ShinyHunters has attracted significant attention for a series of high-profile cyber incidents and confrontations with other criminal groups.

In one recent incident, the group reportedly gained control of the dark-web website operated by rival extortion operation Cl0p. The compromise was linked to the exploitation of a vulnerability in Grav CMS, an open-source content management system.

ShinyHunters has also claimed responsibility for compromising an FBI employment-related portal, reportedly taking approximately three terabytes of data.

The group has maintained that the FBI incident was not primarily motivated by financial demands. Instead, ShinyHunters claimed it wanted to pressure the agency over what it described as inaccurate allegations and statements concerning the group and its alleged links to The Com.

The Com is a loosely organized cybercrime network that has been associated with a wide range of criminal activity, including social engineering, phishing, SIM swapping, extortion and other forms of online and offline abuse.

U.S. authorities, however, have accused ShinyHunters and its associates of carrying out a large-scale extortion campaign against organizations around the world.

Brett Leatherman, assistant director of the FBI’s cyber division, previously said the group and its alleged associates had compromised more than 140 organizations since the previous year and obtained at least $70 million through extortion.

According to Leatherman, the attackers frequently targeted third-party vendors and cloud-based platforms, using stolen information to pressure victims into paying money to prevent the publication of sensitive data.

He also described van der Stap as an alleged leader of the operation and warned other members of the cybercrime network that international borders and online anonymity would not necessarily protect them from investigators.

The latest reported detention of Rey could therefore become significant for investigators attempting to map the relationships between ShinyHunters and other cybercriminal groups.

Security researchers have previously described ShinyHunters as an unusually resilient cybercrime brand that has survived arrests, indictments, law-enforcement actions and the shutdown of underground forums.

A joint analysis by cybersecurity firms Sekoia and Beazley Security traced the group’s roots to earlier cybercrime operations, including TheDarkOverlord and GnosticPlayers, both of which were known for data theft, extortion and leak-based operations.

The ShinyHunters name became publicly prominent around 2020, initially gaining attention through the sale and distribution of stolen databases on underground forums.

Over the years, however, researchers say the name evolved beyond a conventional hacking group into something closer to a recognizable cybercrime brand used by different actors and loosely connected teams.

Security researchers Enzo Saez and Robert Venal described ShinyHunters as a self-sustaining operation whose survival has depended less on a single leader and more on the ability of different participants to perform separate roles.

Those roles can include obtaining initial access to victims, recruiting additional hackers, conducting intrusions, stealing information and eventually monetizing compromised data.

This structure has made the group difficult to eliminate completely, as the arrest or removal of individual members does not necessarily bring the broader operation to an end.

The reported cooperation of Khader with U.S. authorities could nevertheless provide investigators with valuable intelligence about individuals involved in the network, its infrastructure and relationships with other cybercrime groups.

If the information supplied by the suspect leads to additional arrests, it could represent another significant development in the continuing international investigation into ShinyHunters and its associates.

For law enforcement agencies, the case also highlights the increasingly international nature of cybercrime investigations, where suspects, infrastructure, victims and stolen information can span multiple countries and jurisdictions.

As authorities continue following the leads generated by recent arrests and cybercrime investigations, ShinyHunters remains under intense scrutiny, with investigators seeking to determine how its network has operated and which individuals remain active within the broader ecosystem.