Teenager Suspected of Leading ShinyHunters Is Detained in Jordan and Is Cooperating With the FBI
Reuters reports that Saif al-Din Khader, a teenager suspected of leading the ShinyHunters hacking group, is detained in Jordan and is helping the FBI and other agencies locate other members of the group behind a breach of FBI employee data.
ShinyHunters claimed in September that it had infiltrated the FBI's job recruitment portal, stealing confidential data belonging to 5,000 employees and replacing the bureau's logo on the site with its own, according to PC Magazine. Reuters said its analysis of a sample of the data the group shared found extensive personally identifiable information of FBI employees, sensitive job role information, and psychiatric and medical information.
The reported theft of data on every FBI employee has drawn comparisons to the 2015 intrusion at the U.S. Office of Personnel Management, which the material describes as allegedly linked to China and which compromised sensitive details on millions of Americans who had been vetted for security clearances.
One source told Reuters that Khader was walking investigators through his electronic devices and digital correspondence to help the FBI locate his associates. His cooperation, Reuters reported, could be critical to containing, or at least understanding, the damage.
There had been signs for days that ShinyHunters was experiencing disruption after announcing the FBI break-in. Starting on Tuesday, Reuters was unable to reach the group through the online account it had previously used to communicate with journalists, and on Wednesday its dark web site, where it had posted threats to the FBI, disappeared.
FBI Director Kash Patel had hinted at further arrests after the announcement that another alleged ShinyHunters member, Pepijn van der Stap, had been detained in the Netherlands.
Khader's identity and his alleged connection to ShinyHunters have long been known to security researchers. Last year the independent journalist Brian Krebs reported that Khader was a key member of Scattered Lapsus$ Hunters, an umbrella group of hackers that included ShinyHunters. ShinyHunters has been implicated over the years in intrusions at organizations including the European Commission, Grand Theft Auto maker Rockstar Games and the software firm behind Canvas.
Reuters has previously reported that law enforcement agencies around the world, including in the United States, have struggled to arrest and prosecute members of related groups such as Lapsus$ or Scattered Spider. Sources told Reuters the difficulty stems from the hackers' young ages, which can make prosecutions complex, from the chaotic and informal nature of the groups they belong to, or from victims of extortion attempts declining to help investigators.