An international intelligence search following a massive cyber breach into FBI servers has reached a dramatic turning point. According to Reuters, law enforcement authorities in Jordan arrested Saif Al-Deen Khader, a young operative known in the cyber underworld as “ey”. They considered him a central figure in the notorious ShinyHunters cybercrime syndicate. Sources familiar with the investigation confirmed that Khader has begun fully cooperating with the FBI, handing over critical intelligence to federal investigators.
Security officials describe Khader’s cooperation as vital to containing operational damage and assessing the full scope of the intrusion. A source close to the probe said the detainee is surrendering all his electronic devices, mobile phones, and encrypted chat logs to investigators, providing a step-by-step roadmap to help locate and apprehend remaining members of the network. The compromised trove exfiltrated from the FBIJobs.gov recruitment portal contained personally identifiable information (PII), sensitive medical and psychiatric evaluations, and undercover assignments belonging to thousands of federal agents and Department of Justice personnel.
The Jordanian bust sent immediate shockwaves through the cyber underworld. Around the time of Khader’s capture, the syndicate’s official communication accounts vanished, its darknet leak portal went offline, and a panicked surrender abruptly replaced its combative ultimatums to federal law enforcement. In an extraordinary email sent to reporters, group operators struck an unprecedented conciliatory tone: “We want no further escalation with the FBI – consider this a complete retreat of ShinyHunters.”
The breakthrough comes just days after the arrest of another syndicate figurehead, Pepijn van der Stap, in the Netherlands. Deputy Assistant Director of the FBI Cyber Division Brett Leatherman foreshadowed the domino effect last week, warning syndicate members: “Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who is left.”Concurrently, FBI Director Kash Patel confirmed on X that bureau teams are actively pursuing fresh leads and that “”furtherarrests remain on the table.”
Threat researchers have long tracked Khader’s digital identity and ties to high-profile extortion schemes. Independent cybersecurity journalist Brian Krebs previously revealed that Khader operated within the “”cattered Lapsus$ Hunters””collective, which executed sweeping intrusions into commercial enterprises, educational platforms, and gaming giant Rockstar. Although the youth previously claimed he had retired from malicious activity and was cooperating with authorities, the ssyndicate’soperations persisted until the current coordinated international sweep dismantled their infrastructure.