Feed aggregator

COLUMBUS, Ohio (WCMH) -- There are just three days until Ohio State takes on that team up north. The rivalry is firing on all cylinders, and the battle isn't just on the field. It's playing out in living rooms, classrooms, and especially on social media. "I think that there's more opportunities for those extreme views [...]

COLUMBUS, Ohio (WCMH) - The conflict between Hamas and Israel has cooled off after over two years of intense fighting. Jack Chomsky is a former Columbus resident who called Central Ohio home for about 40 years. He now resides in Tel Aviv, Israel a city of almost half a million people. NBC4's Kyle Beachy first [...]

COLUMBUS, Ohio (WCMH) - The Game is only a few short days away. Vegas sportsbooks are once again favoring the Buckeyes this year, even after the team failed to win as 20-point favorites in 2024. Current betting lines have Ohio State as a 9.5-11.5 point favorite over Michigan on the road. ESPN's matchup predictor favors [...]

COLUMBUS, Ohio (WCMH) -- The Ohio National Guard troops that were deployed to Washington, D.C. earlier this year will remain there into February, according to a spokesperson for Gov. Mike DeWine's office. The troops were sent by DeWine in August as part of President Donald Trump's "crime emergency" in Washington. In September, DeWine had extended [...]

COLUMBUS, Ohio (WCMH) -- Just three days away from the rivalry game against Michigan, Ohio State's players aren't just thinking about beating the Wolverines -- they're also giving back. Wednesday afternoon, players came to volunteer with LifeCare Alliance, a non-profit that helps those in the community facing challenges from medical to those working to age [...]

COLUMBUS, Ohio (WCMH) -- Dozens of local families decided to share some holiday joy by bringing home a dog from the Franklin County & Adoption Center for their Thanksgiving sleepovers. “Anytime a dog can spend time outside of the shelter it lowers their stress level,” said Dwayne Young, assistant director of the shelter. It was [...]

COLUMBUS, Ohio (WCMH) -- Nearly 3 million Ohioans are expected to drive to their Thanksgiving holiday destinations this week, according to AAA, and experts say to pay attention to the forecast before starting the trek home after the holiday. Snow or rain is forecast to impact roads statewide this weekend, in combination with the [...]

COLUMBUS, Ohio (WCMH) -- Monday will mark the 37th World AIDS Day, which was started in 1988 by the World Health Organization to raise awareness and understanding of the global AIDS pandemic. All these years later, it is still a day to commemorate and remember those who died from AIDS-related illnesses. But in Columbus, there [...]

Don’t miss it! The annual YouTube telethon to raise money for the ARRL Teachers Institute on Wireless Technology will be held on Saturday, November 29, 2025, beginning at 3 PM EST / 12 PM PST, on the Ham Radio Crash Course YouTube channel, hosted by Josh Nass, KI6NAZ.

Join Nass and several other amateur radio contributors for a fun and entertaining livestream. They’ll cover a variety of amateur ...

COLUMBUS, Ohio (WCMH) – As Ohioans prepare to celebrate Thanksgiving, a central Ohio mother and father are re-emphasizing their long-time message. The Wednesday before Thanksgiving often sees a significant increase in drunk-driving related accidents so Bryan and Teresa Wright are sharing that renewed warning that was born of their family's own tragedy. "I feel 100% [...]

A prolific cybercriminal group that calls itself “Scattered LAPSUS$ Hunters” has dominated headlines this year by regularly stealing data from and publicly mass extorting dozens of major corporations. But the tables seem to have turned somewhat for “Rey,” the moniker chosen by the technical operator and public face of the hacker group: Earlier this week, Rey confirmed his real life identity and agreed to an interview after KrebsOnSecurity tracked him down and contacted his father.

Scattered LAPSUS$ Hunters (SLSH) is thought to be an amalgamation of three hacking groups — Scattered Spider, LAPSUS$ and ShinyHunters. Members of these gangs hail from many of the same chat channels on the Com, a mostly English-language cybercriminal community that operates across an ocean of Telegram and Discord servers.

In May 2025, SLSH members launched a social engineering campaign that used voice phishing to trick targets into connecting a malicious app to their organization’s Salesforce portal. The group later launched a data leak portal that threatened to publish the internal data of three dozen companies that allegedly had Salesforce data stolen, including Toyota, FedEx, Disney/Hulu, and UPS.

The new extortion website tied to ShinyHunters, which threatens to publish stolen data unless Salesforce or individual victim companies agree to pay a ransom.

Last week, the SLSH Telegram channel featured an offer to recruit and reward “insiders,” employees at large companies who agree to share internal access to their employer’s network for a share of whatever ransom payment is ultimately paid by the victim company.

SLSH has solicited insider access previously, but their latest call for disgruntled employees started making the rounds on social media at the same time news broke that the cybersecurity firm Crowdstrike had fired an employee for allegedly sharing screenshots of internal systems with the hacker group (Crowdstrike said their systems were never compromised and that it has turned the matter over to law enforcement agencies).

The Telegram server for the Scattered LAPSUS$ Hunters has been attempting to recruit insiders at large companies.

Members of SLSH have traditionally used other ransomware gangs’ encryptors in attacks, including malware from ransomware affiliate programs like ALPHV/BlackCat, Qilin, RansomHub, and DragonForce. But last week, SLSH announced on its Telegram channel the release of their own ransomware-as-a-service operation called ShinySp1d3r.

The individual responsible for releasing the ShinySp1d3r ransomware offering is a core SLSH member who goes by the handle “Rey” and who is currently one of just three administrators of the SLSH Telegram channel. Previously, Rey was an administrator of the data leak website for Hellcat, a ransomware group that surfaced in late 2024 and was involved in attacks on companies including Schneider Electric, Telefonica, and Orange Romania.

A recent, slightly redacted screenshot of the Scattered LAPSUS$ Hunters Telegram channel description, showing Rey as one of three administrators.

Also in 2024, Rey would take over as administrator of the most recent incarnation of BreachForums, an English-language cybercrime forum whose domain names have been seized on multiple occasions by the FBI and/or by international authorities. In April 2025, Rey posted on Twitter/X about another FBI seizure of BreachForums.

On October 5, 2025, the FBI announced it had once again seized the domains associated with BreachForums, which it described as a major criminal marketplace used by ShinyHunters and others to traffic in stolen data and facilitate extortion.

“This takedown removes access to a key hub used by these actors to monetize intrusions, recruit collaborators, and target victims across multiple sectors,” the FBI said.

Incredibly, Rey would make a series of critical operational security mistakes last year that provided multiple avenues to ascertain and confirm his real-life identity and location. Read on to learn how it all unraveled for Rey.

WHO IS REY?

According to the cyber intelligence firm Intel 471, Rey was an active user on various BreachForums reincarnations over the past two years, authoring more than 200 posts between February 2024 and July 2025. Intel 471 says Rey previously used the handle “Hikki-Chan” on BreachForums, where their first post shared data allegedly stolen from the U.S. Centers for Disease Control and Prevention (CDC).

In that February 2024 post about the CDC, Hikki-Chan says they could be reached at the Telegram username @wristmug. In May 2024, @wristmug posted in a Telegram group chat called “Pantifan” a copy of an extortion email they said they received that included their email address and password.

The message that @wristmug cut and pasted appears to have been part of an automated email scam that claims it was sent by a hacker who has compromised your computer and used your webcam to record a video of you while you were watching porn. These missives threaten to release the video to all your contacts unless you pay a Bitcoin ransom, and they typically reference a real password the recipient has used previously.

“Noooooo,” the @wristmug account wrote in mock horror after posting a screenshot of the scam message. “I must be done guys.”

A message posted to Telegram by Rey/@wristmug.

In posting their screenshot, @wristmug redacted the username portion of the email address referenced in the body of the scam message. However, they did not redact their previously-used password, and they left the domain portion of their email address (@proton.me) visible in the screenshot.

O5TDEV

Searching on @wristmug’s rather unique 15-character password in the breach tracking service Spycloud finds it is known to have been used by just one email address: cybero5tdev@proton.me. According to Spycloud, those credentials were exposed at least twice in early 2024 when this user’s device was infected with an infostealer trojan that siphoned all of its stored usernames, passwords and authentication cookies.

Intel 471 shows the email address cybero5tdev@proton.me belonged to a BreachForums member who went by the username o5tdev. Searching on this nickname in Google brings up at least two website defacement archives showing that a user named o5tdev was previously involved in defacing sites with pro-Palestinian messages. The screenshot below, for example, shows that 05tdev was part of a group called Cyb3r Drag0nz Team.

Rey/o5tdev’s defacement pages. Image: archive.org.

A 2023 report from SentinelOne described Cyb3r Drag0nz Team as a hacktivist group with a history of launching DDoS attacks and cyber defacements as well as engaging in data leak activity.

“Cyb3r Drag0nz Team claims to have leaked data on over a million of Israeli citizens spread across multiple leaks,” SentinelOne reported. “To date, the group has released multiple .RAR archives of purported personal information on citizens across Israel.”

The cyber intelligence firm Flashpoint finds the Telegram user @05tdev was active in 2023 and early 2024, posting in Arabic on anti-Israel channels like “Ghost of Palestine” [full disclosure: Flashpoint is currently an advertiser on this blog].

‘I’M A GINTY’

Flashpoint shows that Rey’s Telegram account (ID7047194296) was particularly active in a cybercrime-focused channel called Jacuzzi, where this user shared several personal details, including that their father was an airline pilot. Rey claimed in 2024 to be 15 years old, and to have family connections to Ireland.

Specifically, Rey mentioned in several Telegram chats that he had Irish heritage, even posting a graphic that shows the prevalence of the surname “Ginty.”

Rey, on Telegram claiming to have association to the surname “Ginty.” Image: Flashpoint.

Spycloud indexed hundreds of credentials stolen from cybero5dev@proton.me, and those details indicate that Rey’s computer is a shared Microsoft Windows device located in Amman, Jordan. The credential data stolen from Rey in early 2024 show there are multiple users of the infected PC, but that all shared the same last name of Khader and an address in Amman, Jordan.

The “autofill” data lifted from Rey’s family PC contains an entry for a 46-year-old Zaid Khader that says his mother’s maiden name was Ginty. The infostealer data also shows Zaid Khader frequently accessed internal websites for employees of Royal Jordanian Airlines.

MEET SAIF

The infostealer data makes clear that Rey’s full name is Saif Al-Din Khader. Having no luck contacting Saif directly, KrebsOnSecurity sent an email to his father Zaid. The message invited the father to respond via email, phone or Signal, explaining that his son appeared to be deeply enmeshed in a serious cybercrime conspiracy.

Less than two hours later, I received a Signal message from Saif, who said his dad suspected the email was a scam and had forwarded it to him.

“I saw your email, unfortunately I don’t think my dad would respond to this because they think its some ‘scam email,'” said Saif, who told me he turns 16 years old next month. “So I decided to talk to you directly.”

Saif explained that he’d already heard from European law enforcement officials, and had been trying to extricate himself from SLSH. When asked why then he was involved in releasing SLSH’s new ShinySp1d3r ransomware-as-a-service offering, Saif said he couldn’t just suddenly quit the group.

“Well I cant just dip like that, I’m trying to clean up everything I’m associated with and move on,” he said.

The former Hellcat ransomware site. Image: Kelacyber.com

He also shared that ShinySp1d3r is just a rehash of Hellcat ransomware, except modified with AI tools. “I gave the source code of Hellcat ransomware out basically.”

Saif claims he reached out on his own recently to the Telegram account for Operation Endgame, the codename for an ongoing law enforcement operation targeting cybercrime services, vendors and their customers.

“I’m already cooperating with law enforcement,” Saif said. “In fact, I have been talking to them since at least June. I have told them nearly everything. I haven’t really done anything like breaching into a corp or extortion related since September.”

Saif suggested that a story about him right now could endanger any further cooperation he may be able to provide. He also said he wasn’t sure if the U.S. or European authorities had been in contact with the Jordanian government about his involvement with the hacking group.

“A story would bring so much unwanted heat and would make things very difficult if I’m going to cooperate,” Saif Khader said. “I’m unsure whats going to happen they said they’re in contact with multiple countries regarding my request but its been like an entire week and I got no updates from them.”

Saif shared a screenshot that indicated he’d contacted Europol authorities late last month. But he couldn’t name any law enforcement officials he said were responding to his inquiries, and KrebsOnSecurity was unable to verify his claims.

“I don’t really care I just want to move on from all this stuff even if its going to be prison time or whatever they gonna say,” Saif said.

COLUMBUS, Ohio (WCMH) -- Ohio State is likely to end eight majors and phase out more than 260 courses in compliance with Senate Bill 1, Ohio's sweeping higher education law. At the Nov. 20 Board of Trustees committee meeting, board members approved phasing out 366 courses, pausing 18 courses and leaving 25 courses still under [...]

COLUMBUS, Ohio (WCMH) -- Ohioans will sit down to a table of turkey, mashed potatoes and pumpkin pie Thursday, but traditional Thanksgiving foods are different than the first Thanksgiving. The first Thanksgiving refers to the 1621 harvest feast between 52 Plymouth colonists and 90 Wampanoag. According to the National Archives, the Thanksgiving story is more [...]

COLUMBUS, Ohio (WCMH) — A man arrested in connection to a shooting which began as a dispute over line-cutting at a central Columbus pizza shop has been sentenced to prison. According to court documents, 33-year-old Willie Stephens pleaded guilty to felonious assault earlier this month and could spend over 10 years in prison for shooting [...]

COLUMBUS, Ohio (WCMH) — The Ohio Supreme Court has ruled that police officers’ identities can be withheld from public records when they are attacked on the job, under a state law that protects the privacy of crime victims.  Tuesday’s ruling stems from a lawsuit filed by The Columbus Dispatch against the Columbus Division of Police [...]

COLUMBUS, Ohio (WCMH) -- After 14 months of service and a week of waiting with no updates, hundreds of Ohio soldiers on Tuesday finally took a step toward coming home. "The message this sends — intentionally or not — is that once the mission is complete, soldiers’ well-being and family responsibilities are secondary considerations," Sgt. [...]

COLUMBUS, Ohio (WCMH) -- A bipartisan bill that would eliminate fees for state IDs and birth certificates for Ohioans experiencing homelessness is headed to the House floor after clearing its committee last week. House Bill 472, sponsored by Reps. Christine Cockley (D-Columbus) and Jodi Salvo (R-Bolivar), passed out of the House Children and Human Services [...]