Actor Profile

ShinyHunters is a prolific data theft and extortion group attributed to multiple high-profile breaches. The suspected leader, a teenager from Amman, Jordan operating under the handle "Rey" (identified as Saif Al-din Khader), was detained by Jordanian authorities in October 2025 and is reportedly cooperating with the FBI. Rey assumed control of the ShinyHunters brand following the September 2025 arrest of Dutch cybercriminal Pepijn van der Stap (alias "Umbreon"). The group's motivation appears to be financial gain through data theft and extortion, with Rey admitting to working with multiple ransomware groups. Evidence suggests Rey's father works for Royal Jordanian Airlines, adding operational security concerns to the group's targeting of aerospace entities.

TTPs (Tactics, Techniques, Procedures)

ShinyHunters exploited CVE-2026-35273, a vulnerability in Oracle PeopleSoft (software-as-a-service platform for HR, benefits, and payroll management), initially as a zero-day starting in June 2025. The group conducted mass exploitation across dozens of systems in multiple sectors. After Oracle patched the vulnerability and Mandiant released web application firewall (WAF) rules, ShinyHunters bypassed these protections using URL-encoding techniques. The group's tactics include data exfiltration followed by extortion, public taunting of victims via social media (Twitter/X), and attempts to frame other threat actors. Key techniques align with MITRE ATT&CK T1190 (Exploit Public-Facing Application), T1567 (Exfiltration Over Web Service), and T1486 (Data Encrypted for Impact/Extortion).

Targets & Patterns

ShinyHunters demonstrated broad targeting across multiple sectors including higher education, technology, healthcare, agriculture, transportation, government, and aerospace/aviation. Notable victims include the FBI recruitment website (exposing data on 5,000+ personnel including medical/psychiatric records), the ransomware group Cl0p, and Jeppesen ForeFlight (a Boeing subsidiary divested in November 2025). The targeting pattern suggests opportunistic exploitation of vulnerable PeopleSoft instances rather than sector-specific focus, though the attempted extortion of Jeppesen ForeFlight—which handles navigation and digital aviation data—raised operational safety and security concerns given the sensitive nature of aviation systems. The FBI breach appears to have been an intentional high-profile target, while other victims were identified through mass scanning for the PeopleSoft vulnerability.

Historical Context

ShinyHunters has been active as a data theft and extortion group for multiple years, with leadership transitioning between operators. The September 15, 2025 arrest of Pepijn van der Stap (Umbreon) marked a shift in operational control to Rey, who immediately claimed responsibility for breaching the FBI and extorting Cl0p while attempting to frame van der Stap. The group began exploiting CVE-2026-35273 as a zero-day in June 2025, initially targeting the FBI's PeopleSoft database (unsuccessfully at first). Following Oracle's patch release and Mandiant's WAF rule publication, ShinyHunters adapted by developing URL-encoding bypass techniques, demonstrating operational resilience. Rey's detention in October 2025 occurred during active extortion of Jeppesen ForeFlight, and his reported cooperation with the FBI may lead to identification of additional ShinyHunters members and affiliated ransomware groups.

Defensive Recommendations

  • Immediately patch CVE-2026-35273 in all Oracle PeopleSoft instances; prioritize internet-facing HR, payroll, and benefits portals
  • Deploy and regularly update web application firewall rules for PeopleSoft, ensuring rules account for URL-encoding and obfuscation techniques that bypass signature-based detection
  • Monitor for T1190 (Exploit Public-Facing Application) by implementing anomalous authentication patterns and unusual data access in PeopleSoft logs, particularly bulk queries or exports from HR databases
  • Implement network segmentation to isolate PeopleSoft instances from other critical systems, limiting lateral movement opportunities following initial compromise
  • Establish data loss prevention (DLP) controls and egress filtering to detect large-scale exfiltration attempts from HR/payroll systems, particularly to cloud storage or file-sharing services (T1567)

---

# Geopolitical Context

Geopolitical Context

The detention of a Jordanian national suspected of leading ShinyHunters represents a significant development in transnational cybercrime enforcement. The case illustrates the growing willingness of Middle Eastern states to cooperate with U.S. law enforcement on cybercrime matters, particularly when domestic equities are at stake. The suspect's alleged targeting of a Boeing-divested aviation unit—while his father reportedly works for the state-majority-owned Royal Jordanian Airlines, which operates Boeing aircraft—may have created domestic political pressure on Jordanian authorities to act. This incident underscores the complex intersection of cybercrime, critical infrastructure security, and bilateral law enforcement cooperation in a region where such collaboration has historically been selective.

State Actor Alignment

The suspect, identified as Saif Al-din Khader (alias "Rey"), was detained by Jordanian authorities and is reportedly cooperating with the FBI to identify other ShinyHunters members. This cooperation appears consistent with Jordan's broader security partnership with the United States. The timing of the arrest—coinciding with ShinyHunters' extortion of Jeppesen ForeFlight, a recently divested Boeing subsidiary handling sensitive aviation data—suggests that threats to aviation safety and U.S. critical infrastructure may have accelerated bilateral enforcement action. ShinyHunters previously exploited CVE-2026-35273 in Oracle PeopleSoft to breach multiple organizations, including an FBI recruitment portal, which exposed data on over 5,000 FBI personnel. The FBI subsequently removed an Accenture contractor over failure to patch the compromised system. No evidence links ShinyHunters to state sponsorship; the group appears to operate as a financially motivated cybercriminal enterprise.

Business Impacty pro region

This case may signal increased Middle Eastern engagement in cybercrime enforcement, particularly when domestic interests align with U.S. priorities. Jordan's cooperation could serve as a model for other regional partners facing pressure to address cybercriminal safe havens. For the aerospace and aviation sectors globally, the incident highlights persistent vulnerabilities in enterprise SaaS platforms and the operational risks posed by data theft from aviation service providers. The breach of Jeppesen ForeFlight—a provider of navigation and digital aviation solutions—raises concerns about potential safety and security implications for airlines worldwide that rely on such systems. European and allied aviation regulators may scrutinize third-party digital service providers more closely. The case also underscores the challenge of attribution and enforcement when cybercriminals operate from jurisdictions with varying levels of rule-of-law infrastructure and political will to prosecute.

Forecast

If Jordanian cooperation yields actionable intelligence on additional ShinyHunters members, U.S. and allied law enforcement may pursue further arrests in jurisdictions willing to extradite or prosecute. If the suspect's cooperation is substantive, it could disrupt ShinyHunters' operations in the near term, though the group's decentralized structure may allow other actors to reconstitute under new branding. If the Jeppesen ForeFlight breach involved operationally sensitive aviation data, regulatory scrutiny of third-party aviation technology providers is likely to intensify, particularly in the U.S. and Europe. If Jordan perceives reputational or economic risk from hosting cybercriminals targeting Western critical infrastructure, Amman may expand domestic cybercrime enforcement capacity. Conversely, if prosecution stalls or the suspect is released, it may signal limits to bilateral cooperation when cases involve juveniles or politically sensitive family connections.