A member of the digital extortion group ShinyHunters, known online as “Rey,” has reportedly been arrested in Jordan. According to Reuters, the individual, whose real name is Saif al-Din Khader, was taken into custody on September 29, 2026. He is said to be cooperating with the FBI and other law enforcement agencies to identify other members of the group.
Rey, also known as ReyXBF, was previously identified as an administrator of the group Scattered LAPSUS$ Hunters (SLH or SLSH). This group is believed to be a combination of Scattered Spider, LAPSUS$, and ShinyHunters. Rey has been involved in various cyber activities, including being an administrator for the ransomware group Hellcat’s data leak website and BreachForums.
The recent arrest is part of ongoing efforts to combat the activities of ShinyHunters. In a separate incident, a 24-year-old individual from Amsterdam, suspected of involvement with the group, was also apprehended. The FBI has stated that more arrests are possible as they continue their investigation.
ShinyHunters has gained notoriety for various cyber exploits, including hijacking the darknet website of a rival group and hacking the FBI’s portal to steal sensitive data. The group has denied seeking monetary gain in these instances, instead aiming to challenge false allegations made against them.
The FBI has warned members of ShinyHunters to come forward and cooperate, as arrests can lead to further revelations about the group’s activities. The origins of ShinyHunters can be traced back to earlier hacking groups, indicating a long history of cyber operations.
Despite facing legal challenges and arrests, ShinyHunters continues to operate, adapting its tactics and business model to evade detection. The group’s resilience lies in its ability to continuously evolve and maintain a presence in the cybercrime landscape.
