Jordan Arrest of ShinyHunters Rey Triggers FBI Cooperation on Repeat Offender Networks

Jordanian authorities detained 19-year-old Saif al-Din Khader in Amman days after the FBIJobs.gov defacement that included a Pokémon Umbreon image. Khader, already tied to Scattered Lapsus$ Hunters, began cooperating with the FBI to map remaining ShinyHunters infrastructure. The same week Dutch police arrested Pepijn van der Stap, previously convicted in 2023 for similar extortion and released under supervision, showing the group’s core operators cycle through limited penalties.

Technical evidence includes the Umbreon defacement pinning the FBI breach on van der Stap’s known alias and a 5,000-record sample sent to media matching claimed FBI employee data. Procurement records and prior court filings confirm van der Stap’s 2023 conviction involved over 140 victims and $70 million in extorted funds, yet supervised release did not prevent re-entry into the same extortion channels.

The pattern reveals systemic weakness in post-conviction monitoring for cyber extortionists. Teen operators like Khader move between jurisdictions with minimal friction while repeat offenders exploit lenient European release conditions. Jordan’s cooperation marks a shift from earlier cases where extradition stalled, but it also exposes how quickly new recruits replace arrested leaders.

FBI statements indicate further arrests are imminent. Expect Jordanian and EU partners to surface additional low-level operators within 90 days if Khader’s information yields infrastructure leads rather than just names.