Law enforcement may have gained an unusually valuable source of intelligence inside one of the most persistent cyber-extortion ecosystems of recent years.
A suspected ShinyHunters member known online as “Rey” or “ReyXBF” was reportedly detained in Jordan on September 29 and is cooperating with the FBI and other authorities to identify additional members of the group. Reuters first reported the detention, citing people familiar with the investigation.
The suspect has been identified as Saif al-Din Khader, a figure previously associated not only with ShinyHunters but with several overlapping cybercrime communities. His cooperation could provide investigators with something that seized servers and cryptocurrency trails cannot always deliver: direct knowledge of the people behind online aliases.
A Familiar Name Across Cybercrime Communities
Independent security journalist Brian Krebs previously identified Khader as one of three administrators associated with Scattered LAPSUS$ Hunters, an online collective believed to combine elements of ShinyHunters, Scattered Spider and LAPSUS$.
Khader has also been linked to the Hellcat ransomware group’s data leak site and previously served as an administrator of BreachForums, one of the most prominent marketplaces used for trading stolen information.
Interestingly, Khader had already told Krebs in 2025 that he had been cooperating with law enforcement since at least June of that year. His reported detention in Jordan now suggests that relationship may have become considerably more important to investigators.
A source familiar with the investigation described his cooperation as critical to efforts to identify and arrest other hackers.
Pressure Is Increasing on ShinyHunters
The development follows another significant law-enforcement action against the ShinyHunters ecosystem. Dutch police recently arrested a 24-year-old Amsterdam man suspected of being one of the group’s leaders.
Independent reports identified the suspect as Pepijn van der Stap, also known online as Umbreon. ShinyHunters has denied that he is connected to the group, but the FBI says information obtained through the arrest is already generating additional investigative leads.
The FBI claims ShinyHunters and associated actors have compromised more than 140 organizations since last year and collected at least $70 million in extortion payments. The group has frequently focused on cloud environments and third-party platforms, stealing large quantities of corporate data before demanding payment to prevent publication.
Recent activity has made the confrontation increasingly public. ShinyHunters claimed responsibility for compromising the FBI’s job application infrastructure and stealing roughly three terabytes of sensitive information. The group says the attack was not financially motivated but intended to challenge FBI claims about its operations and associations.
ShinyHunters Is More Brand Than Traditional Hacking Group
The difficulty for investigators is that ShinyHunters no longer resembles a conventional cybercrime organization with a stable hierarchy.
Research from Sekoia and Beazley Security traces its lineage to earlier groups including TheDarkOverlord and GnosticPlayers. The ShinyHunters name emerged around 2020, initially becoming known for stealing large databases and selling or leaking them through underground forums.
Since then, arrests, indictments and forum seizures have repeatedly disrupted individuals associated with the operation without eliminating the brand.
Researchers increasingly describe ShinyHunters as a flexible cybercrime ecosystem. Social engineers may obtain initial access, other actors provide infrastructure or recruitment, and different participants handle data theft and extortion while operating under a recognizable identity.
That modular structure helps explain why the group has survived repeated disruptions.
Cooperation Can Be More Disruptive Than an Arrest
Khader’s reported cooperation could therefore matter more than the detention itself.
Cybercrime groups rely heavily on pseudonyms, private messaging channels and fragmented relationships to separate online activity from real-world identities. Someone who has administered forums, leak sites and criminal communities may understand connections that investigators would otherwise spend years reconstructing.
Law enforcement has increasingly exploited that weakness by combining arrests with seized infrastructure and cooperating insiders. Each operation can reveal cryptocurrency addresses, chat histories, infrastructure records and relationships that lead to additional suspects.
ShinyHunters has repeatedly demonstrated that taking down one individual is unlikely to eliminate the operation. But the risk changes when investigators begin connecting aliases to identities across an entire network.
For cybercrime groups built around anonymity,the most damaging compromise may not be a seized server or arrested administrator — it may be a trusted insider who starts explaining who everyone really is.