Alleged ShinyHunters member detained in Jordan is reportedly helping the FBI find other members

A suspected ShinyHunters member known online as "Rey" has reportedly been detained in Jordan and is cooperating with the FBI to help locate other members of the extortion group.

According to Reuters, Jordanian authorities detained Rey, identified as Saif al-Din Khader, this week, with two sources saying he was taken into custody on Tuesday.

Two sources familiar with the arrest told Reuters that Khader is helping the FBI and international law enforcement agencies locate other group members.

BleepingComputer has not independently verified the alleged zero-day, lateral movement, or volume of stolen data. The FBI confirmed it was investigating claims of unauthorized activity but did not confirm that data had been stolen.

Dutch police arrested a 24-year-old Amsterdam man on September 15 as part of an investigation into ShinyHunters; KrebsOnSecurity and DataBreaches identified him as Pepijn van der Stap, who previously used the alias "Umbreon."

On Tuesday, an alleged ShinyHunters affiliate who had previously contacted media about the FBI attack and a recent Clop ransomware gang data breach abruptly shut down their online messaging account.

Later, the ShinyHunters data leak site went offline, and the group's main representative stopped responding to questions from the media, including BleepingComputer and Reuters.

It is unclear whether the sudden silence and shutdown of ShinyHunters-linked infrastructure are connected to Khader's reported detention.

The reported detention comes amid an FBI crackdown on ShinyHunters following the group's cyberattack on the bureau.

BleepingComputer contacted ShinyHunters about Rey's reported detention but has not received a response.

After the Dutch arrest, the FBI publicly warned other ShinyHunters members to turn themselves in, saying investigators were still identifying those involved with the group.

"Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left," FBI Cyber Division Assistant Director Brett Leatherman said last week.

"The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours."

The main ShinyHunters representative continued communicating with BleepingComputer after van der Stap's arrest, indicating he was not the person operating that messaging account.

On Thursday, a new ShinyHunters data leak site went online, suggesting other members continue to run the extortion operation.

In recent years, the extortion gang has focused on Salesforce and other cloud SaaS environments, with campaigns linked to breaches at Google, Cisco, and PornHub.

The extortion gang commonly breaches third-party integration companies and uses stolen authentication tokens to access connected SaaS environments and steal customer data.

The gang was behind a data-theft attack on Instructure Canvas in May that caused significant platform outages; the company eventually reached an "agreement" with the threat actors to prevent data stolen in a recent breach from being leaked online.

Numerous arrests have been linked to the ShinyHunters name, including suspects connected to the Snowflake data-theft attacks, breaches at PowerSchool, and the operation of the Breached v2 hacking forum.

The new ShinyHunters leak site went online two days after Khader's reported detention.

In September, ShinyHunters told BleepingComputer that it breached FBI systems using an alleged Oracle PeopleSoft zero-day vulnerability before spreading laterally into FBI-managed AWS GovCloud systems.