# ShinyHunters Extorts Divested Boeing Unit Prior to Leader Arrest in Jordan Jordanian authorities detain hacker Rey amid global extortion campaign and PeopleSoft exploits. - **Source:** [Krebs on Security](https://brifing.si/source/0a287077-2ca9-4c5d-b9aa-b7b61aa8e436) - **Published:** 2026-10-07 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/bd4bf935-0134-4e65-a026-d2d90d25ec12 ## Kingpin Arrested in Amman Jordanian authorities detained Saif Al-din Khader, a teenager operating under the alias Rey, suspected of leading the cybercrime syndicate ShinyHunters. Khader is reportedly cooperating with the FBI to identify additional associates. The arrest occurred as the group actively extorted a newly divested aviation software unit of aerospace giant Boeing. ## Boeing Unit Extortion Details The extortion scheme targeted Jeppesen ForeFlight, a digital navigation business sold by Boeing to Thoma Bravo for $10.55 billion in November 2025. Boeing confirmed awareness of the incident. In response, Jeppesen ForeFlight representatives asserted that proactive security measures prevented any operational disruption or compromise of client navigation products. ## Family Links to Aviation Investigators identified Khader following historical credential leaks from a family computer showing access to Royal Jordanian Airlines employee portals. His father works for the carrier, which operates Boeing passenger aircraft. When approached for comment regarding his son's activities, Khader's family did not respond, prompting the hacker to delete social profiles. ## Exploiting PeopleSoft Flaws ShinyHunters breached dozens of organizations using CVE-2026-35273, a vulnerability within Oracle PeopleSoft human resource software. Although Oracle and Mandiant released patches and firewall filters, the hackers leveraged simple URL-encoding tricks to bypass perimeter protections, compromising systems across higher education, healthcare, technology, agriculture, transportation, and public government sectors. ## Compromise of FBI Portal The syndicate exploited the PeopleSoft flaw against an FBI recruitment platform, stealing records belonging to over 5,000 personnel. The exposed database contained psychiatric, medical, unit, and specialization records. Following the breach, the FBI dismissed an Accenture contractor for failing to deploy necessary software patches on the compromised portal. ## Dutch Accomplice Arrested Prior to Khader's apprehension, Dutch police arrested 24-year-old Pepijn van der Stap in Amsterdam on September 15. Van der Stap, a convicted cybercriminal operating under the alias Umbreon, had presented himself as a reformed security professional at Neo Security while covertly assisting ShinyHunters in carrying out complex extortion campaigns. ## Severe Charges in Netherlands Beyond computer crimes, Dutch prosecutors suspect Van der Stap of orchestrating at least two murder-for-hire plots abroad. Having previously served prison time for stealing millions of euros, his latest detention followed armed raids. The employer's internal forensic audits have not yet uncovered evidence of unauthorized intrusions against internal company systems. ## Syndicate Brand Franchising Originally established around 2019 by French nationals who were subsequently arrested, ShinyHunters has evolved into a decentralized franchise model. New operators acquire legacy cryptographic keys and darknet credentials. Unrelated threat actors continuously reuse the notorious brand name to negotiate corporate ransoms and launch fresh data leak portals across underground forums. ## Underground Backlash and Doxing Cybercrime communities heavily criticized Khader on Telegram for unprofessional behavior, including doxing rival groups like Cl0p and mocking law enforcement with online memes. Rival channels claimed Khader caused roughly $200 million in damages while demanding 25 to 30 percent cuts for brokering extortions on behalf of affiliate groups. ## Hacker Public Relations Strategy ShinyHunters stated to media outlets that hacking government infrastructure was designed as a public relations counter-offensive against FBI advisories. The agency had warned victims that the syndicate often makes fraudulent claims regarding stolen materials. The hackers argued that publicizing high-profile breaches was necessary to rebuild leverage over prospective ransom targets. ## Enterprise Supply Chain Implications The incident demonstrates the systemic risks associated with SaaS vulnerabilities and corporate restructuring transitions. Divested corporate business units often inherit fractured defensive perimeters. Security teams must enforce strict third-party patch verifications and maintain deep credential monitoring to shield critical enterprise infrastructure from legacy vulnerabilities exploited by opportunistic syndicates. ## Sources covering this story - https://krebsonsecurity.com/2026/10/shinyhunters-extorted-boeing-spin-off-prior-to-arrests/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._