ShinyHunters Leader Detained in Jordan; Suspect Cooperates With FBI
A teenager suspected of leading the ShinyHunters extortion group has been detained and is reportedly working with US authorities to identify other members.
Key points
- The suspect, known by the handle "Rey," was detained in Amman, Jordan.
- Rey is reportedly cooperating with the FBI to identify other ShinyHunters members.
- The group was extorting a Boeing spin-off at the time of the detention.
A teenager suspected of leading the prolific data theft and extortion group ShinyHunters has been detained in Amman, Jordan, according to a report by KrebsOnSecurity. The suspect, who operates under the hacker handle "Rey," is reportedly cooperating with the Federal Bureau of Investigation to identify other members of the hacking gang.
The detention occurred while ShinyHunters was actively engaged in extorting a business unit that had recently been divested by Boeing, the global aerospace manufacturer. This timing highlights the operational status of the group at the moment of the suspect's apprehension. The suspect’s father is employed by Royal Jordanian Airlines, which utilizes aircraft manufactured by Boeing.
Context and Background
ShinyHunters has established a reputation for prolific data theft and extortion campaigns targeting various organizations. The group’s activities typically involve stealing sensitive data and demanding payment to prevent its public release. The involvement of a minor in leading such a sophisticated operation underscores the evolving demographics of cybercriminal groups.
The cooperation with the FBI suggests a significant breakthrough in law enforcement efforts to dismantle the network. By identifying other members, authorities aim to disrupt the group’s ongoing operations and prevent further extortion attempts. The connection to Boeing, through both the targeted victim and the suspect’s family, adds a layer of complexity to the case, though the primary focus remains on the criminal activities of the group.
Who Is Affected
The immediate impact of the detention is felt by the members of ShinyHunters, who may now face investigation and potential arrest. The business unit recently divested by Boeing, which was being extorted, may also be affected by the disruption of the criminal campaign. Royal Jordanian Airlines, the employer of the suspect’s father, is indirectly connected to the case but has not been reported as a target of the extortion.
Organizations that have been targeted by ShinyHunters in the past may also be concerned about the stability of the group and the potential for retaliatory actions or data leaks. However, the cooperation of the suspect with authorities may mitigate some of these risks by providing insights into the group’s methods and future plans.
What should you do?
Security professionals should monitor developments in this case for any new information about ShinyHunters’ tactics or targets. Organizations that have been targeted by similar extortion groups should review their incident response plans and ensure that they have robust backup and recovery procedures in place.
What to do and how to stay safe
- Review incident response plans to ensure readiness for potential extortion attempts.
- Ensure robust backup and recovery procedures are in place to mitigate data loss.
- Monitor threat intelligence sources for updates on ShinyHunters’ activities.
- Verify the security of systems that may have been targeted by similar groups.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who is the suspect detained in connection with ShinyHunters?
The suspect is a teenager from Amman,
