A man who last year admitted to working with the ShinyHunters hacking and extortion gang has been detained in Jordan and is working with the FBI to identify other gang members, Reuters reported, in the wake of last month’s major breach of FBI employee data.

Saif al-Din Khader was detained by Jordanian authorities on 29 September, Reuters said in the 3 October report, citing unnamed sources.

One of Reuters’ sources said Khader was walking authorities through the contents of his electronic devices and digital correspondence to help the FBI locate other ShinyHunters members.

Technical admin

“His cooperation is critical to ongoing efforts to arrest these hackers,” this source reportedly said.

Beginning on 29 September, the day Khader was reportedly arrested, Reuters reported that it was unable to communicate with ShinyHunters through the online account it previously used to communicate with journalists.

Khader last November acknowledged to independent journalist Brian Krebs that he had been acting as technical operator and public face of a group at that time referred to as “Scattered LAPSUS$ Hunters”, or SLSH, believed to be an amalgam of the Scattered Spider, LAPSUS$ and ShinyHunters gangs.

On 30 September, the anonymised website used by ShinyHunters went offline, and as of 2 October, an email address linked to the group no longer responded to messages, Reuters’ report said.

Khader’s arrest and the ensuing disruption appear to reflect intense pressure being placed on the group after it claimed to have stolen extensive data on virtually every FBI employee, including sensitive job assignments and medical records.

Data breach

The hack took apparently place in late September, and was acknowledged by the FBI in an internal memo to staff on 25 September.

ShinyHunters initially said it wanted the FBI to remove an advisory about the group that it disliked, threatening to otherwise release the employee data, but later the group said it planned to take no further action and had only intended the hack as a “marketing campaign”.

The agency declined to comment, but said in a statement it was “aggressively” investigating the hack, adding that it had “worked with partners to arrest multiple subjects”.

Scattered Spider, LAPSUS$ and ShinyHunters are believed to be primarily comprised of young English-speaking hackers, mainly British or North American in origin, and have been linked to a number of disruptive hacks on companies including Marks & Spencer, the Co-Op and Jaguar Land Rover.