News Date: 2026-10-04
A suspected participant in the ShinyHunters cybercrime operation has reportedly been detained in Jordan, potentially giving investigators an important source of intelligence on one of the most visible data-extortion communities. The individual, identified as Saif al-Din Khader and known online as Rey or ReyXBF, was reportedly taken into custody on September 29 and is assisting the FBI and other authorities.
Why the detention matters
ShinyHunters has become associated with high-profile data theft, extortion and the operation or promotion of criminal leak platforms. The wider ecosystem has also overlapped with names such as Scattered Spider, LAPSUS$ and Scattered LAPSUS$ Hunters, making attribution difficult. Participants can move between brands, forums and temporary alliances while continuing to use similar social-engineering and extortion methods.
An insider who understands those relationships may be more valuable than a seized server. Infrastructure can be replaced, cryptocurrency can be moved and online identities can be abandoned. Knowledge of real-world identities, communication channels, payment arrangements and operational disputes is harder for a criminal group to rebuild.
What organizations should expect
The reported cooperation does not mean ShinyHunters activity will immediately stop. Decentralized groups commonly fragment after arrests, with remaining members adopting new names or exaggerating their access to maintain influence. Organizations should therefore treat any resulting disruption as an intelligence opportunity rather than evidence that the threat has disappeared.
- Preserve evidence from extortion attempts instead of deleting messages.
- Report incidents promptly to law enforcement and relevant national cyber authorities.
- Monitor identity systems for help-desk impersonation, MFA reset abuse and suspicious session creation.
- Review third-party access because extortion groups frequently target service providers and cloud integrations.
Expert view
In my view, the most important outcome will be whether investigators can convert the reported cooperation into coordinated arrests, infrastructure seizures and financial disruption. Cybercrime brands are disposable, but trusted relationships between operators are not. If authorities can map those relationships, they may weaken several groups at once rather than merely removing one administrator. Security teams should still assume that displaced members will return under different identities and should prioritize behavior-based detection over threat-actor names.