ShinyHunters Suspect Detained in Jordan

A suspected member of the cybercrime group ShinyHunters, Saif al-Din Khader, was detained in Jordan this week and is cooperating with investigators, according to U.S. officials and another source familiar with the case. The FBI declined to comment directly on Khader’s detention, but said it is continuing to investigate the cyber incident and has worked with partners to arrest multiple people. The bureau said it would use all available resources to bring those responsible to justice. ShinyHunters claimed responsibility last month for defacing the FBI’s website and said it had stolen between two and three terabytes of information related to FBI employees. The group also asserted, without public verification, that it had obtained data on every FBI employee. The hackers said they exploited a new vulnerability in Oracle PeopleSoft, a human resources management program. It remains unclear how many alleged hackers may be involved. The article also describes the earlier arrest of a second suspected ShinyHunters member: a 24-year-old man detained in Amsterdam on Sept. 15. Dutch police and the FBI had reported the arrest, but police did not publicly name the suspect. Sources familiar with the case identified him to CBS News as Pepijn van der Stap. His arrest preceded ShinyHunters’ announcement that it had hacked the FBI jobs website, which 404 Media first reported on Sept. 22. In a statement to Reuters, ShinyHunters denied that Van der Stap was associated with the group and criticized Dutch police. The arrest of Khader was first reported by Reuters.

Jordan has confirmed the arrest of a suspected member of the ShinyHunters cyber-extortion group, whose members claim responsibility for stealing data on every FBI employee. Jordanian state media reported that investigations into the suspect and the group’s connections are continuing. Reuters, citing sources, identified the detained man as Saif Al Din Khader, also known by the online name “Rey.” Authorities in Jordan have not publicly disclosed his identity. Sources said Khader is cooperating with the FBI and other law-enforcement agencies, sharing electronic devices and digital correspondence to help investigators find other members. A source described his cooperation as critical to efforts to make further arrests. ShinyHunters has conducted attacks against major corporations for years. Analysts believe the group consists mainly of young, English-speaking hackers. Journalist Brian Krebs previously reported that Khader was a prominent member of Scattered Lapsus$ Hunters, a network that included ShinyHunters, and said Khader had told him he had quit hacking and was cooperating with law enforcement. Despite that reported claim, ShinyHunters continued to operate, taking credit for breaches involving Rockstar Games and education platform Canvas. In September, the group said it had obtained extensive data on every FBI employee. Reuters examined a sample and found personally identifiable information, including sensitive employment, psychiatric and medical details. FBI Director Kash Patel had indicated that further arrests were possible following the detention in the Netherlands of another alleged ShinyHunters member, Pepijn van der Stap. The FBI declined to discuss specific activity in Jordan but said it was aggressively investigating the incident and would pursue those responsible. The group’s dark-web site went offline the week before publication, and a request for comment received no response, suggesting possible disruption after the claimed FBI breach.

Reuters reports that Saif al-Din Khader, a suspected member of the ShinyHunters hacking group, was detained by Jordanian authorities during the week of the report. Three people familiar with the matter told Reuters about the detention; two said Khader was taken into custody on Tuesday. The sources said he is cooperating with the FBI and helping U.S. and international law enforcement identify or locate other hackers. Reuters said it could not immediately establish the circumstances of the detention or where Khader is being held. His alleged hacker nickname is Rey. The report links the detention to a cyber incident in which ShinyHunters allegedly claimed to have stolen data on every FBI employee. The FBI did not comment on a specific arrest or overseas activity. It said it was aggressively investigating the incident, had worked with partners to arrest multiple subjects, and would commit resources to bringing those responsible to justice. Attempts over the preceding week and a half to contact Khader or members of his family were unsuccessful. The article describes the detention as the latest development in the case. It characterizes ShinyHunters as a prolific cyber-extortion group with a history of targeting major corporations worldwide. Experts believe the group consists mainly of young, English-speaking hackers whose activities focus on data theft and extortion. The report attributes information about Khader’s detention and cooperation to unnamed sources and presents the allegation of his membership in the group as a suspicion, not an established finding.