ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members

In the wake of these arrests, the leadership of the FBI has taken an uncharacteristically public and combative stance. FBI Director Kash Patel utilized social media to signal that the investigation is rapidly gaining momentum. In a series of posts, Patel emphasized that the bureau is actively pursuing new leads generated by the recent detentions and warned that further arrests are imminent. This public posturing appears to be part of a broader psychological operation intended to sow distrust among the remaining members of the group and pressure them into surrendering.

The recent activities of ShinyHunters explain why the group has become a top priority for federal investigators. In a daring display of technical skill and criminal hubris, the group recently hijacked the darknet presence of a rival cybercriminal organization, the Cl0p ransomware gang. By exploiting an unpatched vulnerability in the Grav Content Management System (CMS), ShinyHunters seized control of Cl0p’s leak site, effectively "hacking the hackers." Furthermore, the group claimed a direct strike against the FBI itself by breaching the "apply.fbijobs.gov" portal. During this intrusion, they allegedly exfiltrated approximately three terabytes of sensitive data, including information related to potential applicants for positions within the bureau.

The motive behind the FBI job portal breach appears to be more political than financial. ShinyHunters asserted that they were not seeking a ransom payment for the stolen data. Instead, they claimed the hack was an effort to force the FBI to retract what the group described as false allegations. Specifically, the group has taken issue with the FBI’s attempts to link them to "The Com," a decentralized and notoriously violent cybercrime collective. The Com is known not just for digital crimes like SIM swapping and phishing, but for real-world violence, including kidnapping, physical assault, and the practice of "swatting"—sending armed police responses to the homes of targets under false pretenses. ShinyHunters has sought to distinguish its "business-oriented" model of data extortion from the more chaotic and brutal tactics associated with The Com.

Despite the group’s attempts to frame themselves as high-end digital entrepreneurs, the FBI maintains a starkly different view of their impact. Brett Leatherman, the assistant director of the FBI’s cyber division, provided a sobering assessment of the group’s reach. According to Leatherman, the collective and its co-conspirators have compromised more than 140 organizations since last year, extracting an estimated $70 million in extortion payments. Their primary tactic involves targeting third-party vendors and cloud-based platforms, which allows them to gain access to vast repositories of sensitive customer data that can then be used as leverage against the victimized corporations.