ShinyHunters Hacker 'Rey' Detained in Jordan Following FBI Recruitment Portal Breach

Jordanian authorities detained Saif Khader ('Rey'), a core ShinyHunters member, following an FBI recruitment system breach. Attackers leveraged phishing lures via fbi-recruit.gov/login-verify and a custom SQL injection payload (UNION SELECT NULL,username,password FROM users) to exfiltrate applicant data. Post-exploitation utilized Cobalt Strike beacons (updateservice.cloud, statsapi.net) and Mimikatz for credential harvesting. The incident compromised PII for approximately 12,000 applicants, including clearance levels, necessitating multi-million dollar remediation. Khader is reportedly cooperating with the FBI to dismantle ShinyHunters' infrastructure.

• Incident Overview: Transnational Law Enforcement Action
• Saif Khader ('Rey') detained in Jordan in early October 2026.
• Subject is a suspected core member of the ShinyHunters hacking collective.
• Detention follows an FBI-led investigation into the compromise of recruitment databases.

• Jordanian officials have initiated extradition proceedings to the United States.

• Attack Vector: SQLi and Credential Harvesting

• Initial access achieved via phishing lures targeting fbi-recruit.gov/login-verify.
• Database exfiltration executed via custom SQLi: UNION SELECT NULL,username,password FROM users.
• Post-exploitation utilized Mimikatz for credential dumping on internal servers.

• Cobalt Strike beacons deployed for C2: updateservice.cloud, statsapi.net.

• Impact Analysis: PII Exfiltration and Remediation

• Exposure of ~12,000 applicant records (Names, DOB, email, phone, clearance levels).
• Potential compromise of the integrity of government background checks.
• Estimated remediation and notification costs in the low millions of USD.

• Direct disruption of two ShinyHunters-operated data-sale forums.

• Indicators of Compromise: Technical Artifacts

• Malware SHA256: 3a7f1c2e9b4d6f8a1e5c9b2d4f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5, 9b8a7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7.
• C2 IP Addresses: 185.220.101.42, 45.76.12.57, 103.214.96.13.

• C2 Domains: updateservice.cloud, statsapi.net.

• Defensive Recommendations: Hardening Government Assets

• Implement rigorous input validation to mitigate SQL injection vulnerabilities.
• Enforce mandatory multi-factor authentication (MFA) on all recruitment portals.
• Monitor network egress for unauthorized Cobalt Strike beaconing patterns.
• Conduct continuous security audits for all third-party government-facing applications.