ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members

Khader, who also operated under the moniker ReyXBF, is far from an obscure figure in the world of illicit data brokerage and digital extortion. His arrest in Jordan is being viewed as a pivotal moment for investigators, as reports suggest that Khader is currently cooperating with the FBI and other international law enforcement agencies. This cooperation is expected to provide critical intelligence regarding the internal hierarchy, operational protocols, and identities of other members within the ShinyHunters network. One source noted that Khader’s willingness to provide information could be the key to unmasking the remaining actors in a group that has historically proven to be exceptionally elusive.

The profile of Saif al-Din Khader reveals a career deeply embedded in the most active corners of the cybercriminal underground. In late 2025, independent security journalist Brian Krebs identified Khader as one of the primary administrators of an entity known as Scattered LAPSUS$ Hunters (SLH). This group is widely believed to be a sophisticated amalgamation of three of the most disruptive threat actor groups in recent history: Scattered Spider, LAPSUS$, and ShinyHunters. By merging their resources and expertise, these groups created a formidable alliance capable of targeting high-value corporate assets with unprecedented efficiency.

Khader’s influence extended beyond the SLH umbrella. He was previously recognized as an administrator for the data leak site of Hellcat, a ransomware-as-a-service (RaaS) operation that emerged in the latter half of 2024. Perhaps most significantly, Khader is alleged to have taken over the leadership of the most recent iteration of BreachForums, the premier destination for the sale and distribution of stolen databases. Interestingly, Khader’s relationship with law enforcement may not be entirely new; he reportedly informed Krebs that he had been in contact with authorities and cooperating in some capacity since at least June 2025. This suggests a complex, double-sided existence that may have finally collapsed with his formal detention in Jordan.

The apprehension of Khader is the second major blow dealt to the ShinyHunters brand in a matter of weeks. Just prior to the news from Jordan, authorities in the Netherlands arrested a 24-year-old man in Amsterdam in connection with the group’s malicious operations. While official channels were initially reserved regarding his identity, subsequent reports identified the man as Pepijn van der Stap. Van der Stap occupied a unique position in the tech world, serving as an offensive security lead at the Dutch firm Neo Security. His arrest highlighted the often-blurred lines between the professional cybersecurity sector and the underground hacking scene. Despite the evidence presented by investigators, a spokesperson for ShinyHunters denied any affiliation with van der Stap, a move that some analysts view as an attempt to maintain operational security or distance the "brand" from individuals who have been compromised.