Crime · updated 1h ago · 3 min read
Jordan Detains ShinyHunters Suspect Saif Al-Din Khader, FBI Probe Continues
Saif al-Din Khader, alias Rey, detained in Jordan in FBI data-theft investigation. Cooperating with the FBI to locate other ShinyHunters members.
Whether ShinyHunters’ posted data/disruption is linked to Khader’s detention.
6 of 7 outlets skipped it: hackread cites Krebs identifying Rey as a teen from Amman.
12outlets compared
Same story, two versions
tap a side to read it in full
BleepingComputer
“It is unclear whether the sudden silence and shutdown of ShinyHunters-linked infrastructure are connected to Khader's reported detention.”Read the original ↗
Hackread
“The detention follows ShinyHunters’ Septemberattack on the FBI Jobs portal.”Read the original ↗
One outlet hedges causality; another implies a direct sequence tying events.
Jordan detains “Rey”
Jordanian authorities detained Saif al-Din Khader, a suspected member of the ShinyHunters hacking group, and two sources said he was brought into custody on Tuesday while Reuters could not immediately determine the circumstances or where he is being held. The FBI declined to comment on any specific arrest or activity abroad while saying it “continues to aggressively probe the recent cyber incident allegedly involving ShinyHunters.” Reuters also reported that attempts to reach Khader and members of his family over the past week and a half have been unsuccessful, and the detention was described as the latest twist in a case tied to ShinyHunters’ claim that it stole data on every FBI employee.
The420.in said Khader’s alleged hacker alias is “Rey,” and it reported that two sources said he is now assisting the FBI and other law-enforcement agencies in locating alleged ShinyHunters members. Reuters further reported that Khader’s detention follows ShinyHunters’ claim that it compromised systems linked to the FBI and obtained data relating to every bureau employee, a full scale of the breach that Reuters said has not been independently confirmed.
FBI investigation and disruption
The FBI said it “will spare no resource in bringing each of the responsible individuals to justice,” while Reuters reported that the bureau continues to investigate the recent cyber incident allegedly involving ShinyHunters. Reuters reported that for days there had been hints of disruption, because Reuters was unable to reach ShinyHunters through the online account it previously used to communicate with journalists beginning on Tuesday, and the group’s dark web site disappeared on Wednesday. FBI Director Kash Patel hinted at more arrests after Pepijn van der Stap was detained in the Netherlands, and Patel said, “FBI teams are working new leads RIGHT NOW.”
BleepingComputer said the ShinyHunters gang claimed it breached FBI systems using an alleged Oracle PeopleSoft zero-day vulnerability before spreading laterally into FBI-managed AWS GovCloud systems, and it said the threat actors claimed they stole between 2TB and 3TB of data. BBleepingComputer added that the FBI previously confirmed it was investigating unauthorized activity but did not confirm that data had been stolen, and it said it has not independently verified the alleged zero-day, lateral movement, or volume of stolen data.B
What Khader’s cooperation means
One source said Khader was walking investigators through his electronic devices and digital communications to help the FBI locate his cohorts, and his cooperation could be critical to helping contain or at least understand the damage. The420.in reported that one source said Khader was walking law-enforcement officials through his electronic devices and digital communications to help identify other members of the network, and it said the FBI declined to discuss the specific detention. Reuters also reported that a sample of data shared by ShinyHunters contained extensive personally identifiable information of FBI employees, sensitive job-role information, and psychiatric and medical information, and it said that makes the alleged breach particularly serious.
The420.in said ShinyHunters later claimed that around 38,000 FBI personnel were affected, while Reuters said the full scale of the breach has not been independently confirmed. Reuters reported that the detention comes as ShinyHunters’ public tone shifted, with the group telling Reuters it wanted no further escalation with the FBI and indicating the statement could be interpreted as ShinyHunters “backing down completely.”