[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fztGusfvJF6iueAW8JOuTo14UhAtQE2fqtAAWzNXjExA":3},{"article":4,"iocs":53,"watch_terms":65,"solutions":66,"lesson":69},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"1ac4badd-6205-4354-901c-9c7559f87dac","ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members","shinyhunters-suspect-rey-reportedly-detained-in-jordan-helping-fbi-identify-grou-5b2c32","A suspected member of the ShinyHunters digital extortion group, who goes by the online alias \"Rey,\" has been allegedly detained by authorities in Jordan, Reuters reported, citing three people familiar with the matter. Rey, whose real name is Saif ‌al-Din Khader, is said to have been brought into custody on September 29, 2026, cooperating with the U.S. Federal Bureau of Investigation (FBI) and","A suspected member of the ShinyHunters group, known as 'Rey' (Saif al-Din Khader), has been detained in Jordan and is reportedly cooperating with the FBI. Rey, also linked to other cybercrime groups like Scattered LAPSUS$ Hunters and Hellcat, has allegedly been involved in breaching over 140 organizations and extorting millions. This development follows the recent arrest of another individual in Amsterdam and is part of ongoing efforts to dismantle the ShinyHunters network.","ShinyHunters suspect 'Rey' detained in Jordan, cooperating with FBI.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fshinyhunters-suspect-rey-reportedly.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjkLNgAfzHHwGX_2W-2iGuIMpKX_ZOPM0xFYMFDUp5kxBp3XfaRHV0EUwHsbvh45q8wVSYvblXfru1NzEKovvRqXHDNA82iWx6IbY_ihCrucvF5Bkr1JU8bVJ9KDzUi0wG1GRYvyPNb-1LcXTWzBhqLS5kRo9o2zf3DnqqcTNqk5gTtfbdC57w5SZnomx5U\u002Fs1600\u002Fshinyhunters-arrested.jpg","2026-10-04T07:22:05+00:00","2026-10-04T08:00:20.161654+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"ShinyHunters","threat_actor",{"name":21,"type":19},"Scattered Spider",{"name":23,"type":19},"LAPSUS$",{"name":25,"type":19},"Hellcat",{"name":27,"type":19},"The Com",{"name":29,"type":19},"Cl0p","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":52},{"id":30,"icon":32,"name":33,"slug":34},[54,58,61,63],{"type":55,"value":56,"context":57},"domain","apply.fbijobs[.]gov","FBI portal allegedly hacked by ShinyHunters",{"type":59,"value":23,"context":60},"malware","Associated with Scattered LAPSUS$ Hunters group",{"type":59,"value":25,"context":62},"Ransomware group Rey was an administrator for",{"type":59,"value":29,"context":64},"Fellow cybercriminal outfit whose darknet website was hijacked",[],{"controls":67,"vendors":68},[],[],{"slug":70,"title":71,"body":72,"framework_refs":73,"framework_notes":86},"shinyhunters-suspect-detained-cooperating-with-fbi-to-expose-group","ShinyHunters Suspect Detained, Cooperating with FBI to Expose Group","The detention of ShinyHunters member 'Rey' and his cooperation with the FBI highlights how organized cybercrime groups can breach over 140 organizations through coordinated intrusion and extortion campaigns. The group's ability to operate across multiple aliases and affiliated crews (Scattered LAPSUS$, Hellcat) demonstrates the challenge of attributing attacks and dismantling loosely federated threat actor networks. Organizations victimized by such groups often suffer from insufficient access controls and monitoring that allow attackers to persist undetected for extended periods. This case underscores the critical importance of threat intelligence sharing, rapid incident response, and law enforcement collaboration in countering large-scale cybercriminal enterprises.",[74,75,76,77,78,79,80,81,82,83,84,85],"CIS Control 5 – Account Management","CIS Control 8 – Audit Log Management","CIS Control 17 – Incident Response Management","NIST SP 800-61 Rev. 2 – Computer Security Incident Handling Guide","NIST AC-2 – Account Management","NIST AC-6 – Least Privilege","NIST SI-4 – Information System Monitoring","NIST IR-4 – Incident Handling","MITRE ATT&CK – Exfiltration (TA0010)","MITRE ATT&CK – Valid Accounts (T1078)","GDPR Article 33 – Notification of Personal Data Breach to Supervisory Authority","ITIL – Major Incident Management Process",{}]