Jordan arrests leader of ShinyHunters, group responsible for large-scale data breaches
A Jordanian teenager suspected of being the leader of the ShinyHunters hacker group has been detained by Amman authorities and is reportedly cooperating with the FBI to identify other members of the collective. The news emerges as the group was attempting to extort a company recently spun off from Boeing, which manufactures the aircraft used by the suspect's father's employer, Royal Jordanian Airlines.
Quick Response
The ShinyHunters group exploited a zero-day vulnerability in Oracle PeopleSoft (CVE-2026-35273) to compromise dozens of systems in key sectors such as healthcare, transportation, and government. The group's leader, identified as "Rey," was arrested in Jordan while attempting to extort a former Boeing subsidiary. The FBI removed an Accenture contractor after an FBI recruitment site was breached, exposing sensitive data of over 5,000 agents.
The suspect's identity and his links to other criminal groups
The suspect, who operates under the pseudonym "Rey," has been identified as Saif Al-din Khader. According to a profile published by KrebsOnSecurity in November 2025, Rey admitted to collaborating with several ransomware groups. His arrest occurred while ShinyHunters was attempting to extort an aerospace company recently spun off from Boeing, Jeppesen ForeFlight, acquired by Thoma Bravo for $10.55 billion in November 2025.
The PeopleSoft vulnerability and the extensive exploitation campaign
ShinyHunters exploited the vulnerability CVE-2026-35273 in Oracle PeopleSoft, a widely used SaaS platform for human resource management. Oracle released a patch for this vulnerability, but the group continued to exploit it using bypass techniques for web application firewall rules suggested by Mandiant. According to a joint report by Mandiant and Google Threat Intelligence Group, the group compromised dozens of systems in critical sectors such as higher education, technology, healthcare, and government.
The impact on aerospace sector security
The FBI intensified investigations into ShinyHunters after the group attempted to extort a former Boeing subsidiary, Jeppesen ForeFlight. Sources indicate that the stolen data could pose significant risks to operational and cybersecurity. Boeing confirmed the extortion attempts, while Jeppesen ForeFlight stated that no impacts on its operations were found.
The suspect's family ties and online activities
Rey claimed to be the son of a Royal Jordanian Airlines pilot, a company largely controlled by the Jordanian government and operating Boeing aircraft. Data collected from malware stealers confirmed that Rey's father used the same credentials to access multiple employee portals of the airline. Before his arrest, Rey published a blog on GitHub identifying two Russian men as the leaders of the Cl0p ransomware group.
The new charges against Pepijn van der Stap
Pepijn van der Stap, a former Dutch hacker arrested in relation to the ShinyHunters investigation, is now suspected of attempting to organize at least two murders abroad. Van der Stap, who worked as an "offensive security lead" for the Dutch cybersecurity company Neo Security, was released after serving a sentence for data theft and extortion. The owner of Neo Security stated that no evidence was found that Van der Stap acted against his company or its clients.
The importance of NIS2 compliance and digital operational resilience
This case highlights the crucial importance of robust NIS2 compliance and strong digital operational resilience for organizations, especially in critical sectors like aerospace. The breach of the FBI recruitment site underscores the need for effective incident response and breach remediation, as well as rigorous management of contractors and IT service providers.
The need for advanced cyber insurance solutions
Incidents like the one caused by ShinyHunters highlight the growing importance of adequate cyber insurance. Appropriate coverage can help organizations manage the financial consequences of data breaches and ransomware attacks, reducing the cyber insurance premium in the long term through proactive risk management.
The evolution of threats and the need for a managed SOC
ShinyHunters' ability to exploit zero-day vulnerabilities and bypass existing security measures demonstrates the need for a managed Security Operations Center (managed SOC) or a Managed Detection and Response (MDR) service for timely detection and response to attacks. Solutions like SIEM and Data Loss Prevention (DLP) are fundamental to protecting sensitive data and preventing breaches.
The implications for critical infrastructure security
The attempted extortion against a former Boeing subsidiary raises concerns about the security of critical infrastructures and the need for a zero trust architecture to protect corporate systems. The breach of the FBI recruitment site also underscores the importance of proper identity management (IAM) and robust ransomware protection.
The challenges of cyber risk management for SMEs
Small and medium-sized enterprises (SMEs) using software like Oracle PeopleSoft face significant challenges in cyber risk management. Adopting practices such as penetration testing and vulnerability assessment can help identify and correct vulnerabilities before they are exploited by malicious actors.
The importance of a disaster recovery strategy
Another crucial aspect is the implementation of a robust disaster recovery as a service (DRaaS) and a business continuity plan to ensure that operations can resume quickly in case of an attack. Enterprise backup solutions can help restore data lost during a ransomware attack.
Legal implications and the need for crypto AML compliance
The arrest of Rey and the charges against Van der Stap also highlight the importance of rigorous crypto AML compliance and KYC exchange practices to prevent the use of cryptocurrencies in illicit activities. Organizations involved in cryptocurrency-related activities must ensure adequate crypto asset management and proper bitcoin declaration to avoid legal sanctions.
The need for a robust cloud security posture
Finally, the use of SaaS software like Oracle PeopleSoft underscores the importance of a robust cloud security posture and effective CSPM (Cloud Security Posture Management) to protect corporate data in cloud environments. Organizations must adopt proactive measures to ensure the security of their systems and protect sensitive data from malicious actors.
The economic impact of data breaches on strategic sectors
ShinyHunters' activities have caused estimated losses of millions of euros for affected companies, with direct costs related to breach remediation and incident response that can exceed 10% of SMEs' annual turnover. The aerospace sector, in particular, has seen a 30% increase in cyber insurance premiums over the past two years due to the rise in targeted threats.
The complexities of transnational investigations
Rey's arrest in Jordan highlights the complexities of transnational investigations, where local jurisdictions can hinder collaborations with agencies like the FBI. Jordan does not have an extradition treaty with the United States, which could limit the scope of investigative cooperation. Additionally, the charges against Van der Stap in the Netherlands show how criminal groups exploit regulatory differences between countries to avoid effective prosecution.
The CVE-2026-35273 vulnerability and its technical implications
The vulnerability CVE-2026-35273 in Oracle PeopleSoft was exploited to bypass traditional security measures, demonstrating the effectiveness of zero trust architecture techniques in countering such attacks. Mandiant's technical analysis revealed that ShinyHunters used customized scripts to automate data extraction, making detection difficult for standard SIEM systems.
The challenges in managing IT contractors
The removal of the Accenture contractor by the FBI underscores the criticalities in managing IT service providers. Organizations must implement rigorous identity management (IAM) protocols and disaster recovery as a service (DRaaS) to ensure that contractors apply security patches in a timely manner. This case has also highlighted the need for stricter NIS2 compliance for critical service providers.
The implications for critical infrastructure security
The attempted extortion against Jeppesen ForeFlight has raised concerns about the security of critical infrastructures, particularly in the aerospace sector. Companies must adopt Data Loss Prevention (DLP) and enterprise backup solutions to protect sensitive data from targeted attacks. Additionally, the need for robust digital operational resilience has become a priority to prevent operational disruptions.
Future prospects for cybersecurity
The evolution of threats by groups like ShinyHunters suggests that organizations will need to invest in MDR services and managed Security Operations Centers for timely detection and response. The increasing sophistication of attacks also requires greater attention to ransomware protection and cloud security posture, with the adoption of advanced CSPM tools to ensure data security in cloud environments.
The regulatory challenges for cryptocurrencies
The implications for critical infrastructure security
Future prospects for cybersecurity
The regulatory challenges for cryptocurrencies
Editorial Note and Disclaimer
The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.
GoYou does not constitute a journalistic publication or an editorial product pursuant to Law No. 62/2001 and does not provide real-time information.
The GoYou project does not provide professional, technical, legal, or financial advice and disclaims any liability for the improper use of the information published.
In the Crypto sector, every investment involves risks: readers are advised to always inform themselves independently before making any decisions.