Rey

☆ pin

Also known as Ryan Moran, rmoskovy, Saif Al-din Khader, ReyXBF

Reports

First seen

Sep 28, 2026

Last seen

Oct 10, 2026

Motivation

Financial

Targeting

Sectors

Government ×1

Victim regions

×3

United States×3

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1005 Data from Local System ×3T1566 Phishing ×3T1190 Exploit Public-Facing Application ×2T1567 Exfiltration Over Web Service ×2T1041 Exfiltration Over C2 Channel ×1T1078 Valid Accounts ×1T1598 Phishing for Information ×1

Indicators

domain ×2cve ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2026-35273 (exploited)

Recent reports

High

FBI Arrests Canadian Ransomware Negotiation Firm Co-founder in ShinyHunters Investigation

KrebsOnSecurityOct 10, 2026 High

ShinyHunters suspect Rey detained in Jordan, assisting FBI investigation

The Hacker NewsOct 4, 2026 Critical

Dutch Police Arrest Reformed Hacker Linked to ShinyHunters Data Theft Group

KrebsOnSecuritySep 28, 2026

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.