A suspected leader of the ShinyHunters extortion group, known online as “Rey,” was reportedly detained by Jordanian authorities, according to reports that surfaced this week describing an arrest that took place days earlier.
Two sources say the suspect, identified as Saif al-Din Khader, was taken into custody on Tuesday, September 29, though the detention was not publicly reported until this week. Jordanian officials have confirmed that an arrest took place in connection with a U.S. hacking and data-theft case, according to regional press coverage.
Suspect Reportedly Cooperating With FBI Investigators
Khader is reportedly cooperating with the FBI, walking investigators through his electronic devices and digital communications in an effort to help identify other alleged members of the group. No formal U.S. charges against Khader have been confirmed as of this report, and the scope of what his cooperation has yielded so far has not been disclosed.
Krebs First Identified Rey as a Jordanian Teenager
Khader was first publicly identified as a ShinyHunters-linked Jordanian teenager by security journalist Brian Krebs in November 2025, nearly a year before this detention was reported. ShinyHunters operates in a loose alliance with the Scattered Spider and LAPSUS$ hacking collectives, groups that U.S. and European law enforcement have linked to a string of high-profile extortion and data-theft campaigns against large corporations.
The detention follows ShinyHunters’ recent claims of stealing FBI employee personnel data, among other high-profile extortion activity the group has claimed credit for in its ongoing campaigns.
Part of a Broader Law Enforcement Push Against the Alliance
Rey’s reported detention adds to a string of recent law enforcement actions against the Scattered Spider/LAPSUS$/ShinyHunters alliance, including the arrest of a member in Amsterdam and the arrest of a 16-year-old described as the leader of the KillSec ransomware group. Taken together, these actions signal continued international pressure on a loose network of young, English-speaking hackers that has been linked to some of the most disruptive extortion campaigns of the past two years.
Why Cooperating Suspects Pose a Unique Risk to Loosely Organized Groups
Groups like ShinyHunters, Scattered Spider, and LAPSUS$ have historically operated as decentralized collections of individuals coordinating primarily through chat platforms rather than as a hierarchical criminal organization. That structure has made the alliance resilient to the arrest of any single member, since operational knowledge is often distributed rather than centralized. A cooperating suspect who held a leadership-level role and is reportedly walking investigators through devices and communications represents a different kind of risk to the group’s operational security than a lower-level member’s arrest would, because leadership-level access can expose a wider web of contacts and historical campaign details.
Security researchers who track these groups have noted a pattern in which several alleged members are teenagers or young adults operating from outside the jurisdictions where their victims are based, which has complicated extradition and prosecution efforts even as law enforcement agencies build cases against them. The gap between Krebs’ public identification of Rey and this reported detention illustrates the lag that can exist between identifying a suspect and an eventual arrest, particularly when the suspect operates from a jurisdiction without a straightforward extradition relationship with the United States.
Impact on ShinyHunters’ Ongoing Operations
If Rey’s cooperation leads to the identification of additional ShinyHunters members, the group’s ability to continue its extortion campaigns could be disrupted, particularly if the FBI can use the information to move against other individuals before they anticipate exposure. ShinyHunters has remained active and highly visible in its extortion claims in recent months, and a leadership-level arrest with confirmed cooperation represents one of the more significant disruptions to the group’s public posture reported so far.
The absence of confirmed U.S. charges against Khader at this stage leaves open how the case will proceed, including whether Jordan will extradite him to face prosecution in the United States or whether any charges will instead be pursued through Jordanian courts. FBI investigators continuing to work from Khader’s cooperation may yield further identifications before any formal charging decision becomes public, since the agency’s stated approach so far has been to use the access it has gained from his devices to pursue additional members of the alliance.
