Fired hacker twins forget to end Teams recording, capture own crimes
Perhaps you remember Muneeb and Sohaib Akhter, the 34-year-old twin brothers we profiled earlier this week. Although they had the tech chops to commit years of petty crimes (like stealing airline miles), what landed them in truly serious trouble was deleting 96 US government databases in the hour after both were fired last year by the same federal IT contractor, Opexus. (Opexus had just found out that both brothers had previously been in prison for cyberfraud.)
The pair come off less as cybercriminal masterminds than as galumphing galoots—that is to say, a pair of bumbling oafs who thought that asking AI how to cover their tracks was going to keep them out of federal prison.
One of the minor mysteries I encountered while writing the piece was that the government had a verbatim transcript of everything the brothers said to each other during their hour-long deletion spree. The two men lived together in Arlington, Virginia, so it made sense that they might be chatting in the same room rather than by text or instant message. But how the heck had the government gotten access to the audio? Supersecret software bugging? Crazy corporate spyware running on their company laptops? FBI agent in the bushes with a microphone?
I couldn’t figure it out, and the answer didn’t appear in any of the court documents I read. But a helpful source today pointed me to the answer. It is contained within a court filing that bears the unpropitious name, “UNITED STATES’ RESPONSE IN OPPOSITION TO DEFENDANT’S MOTION TO REVOKE THE DETENTION ORDER.”
This is the kind of title that practically begs you not to read its contents. Yet the file turns out to be fascinating. And it reveals that our galumphing galoots were supersecretly recorded by… themselves.
On accident.
Because they forgot to stop recording the Teams meeting in which they were fired.
You can’t make this stuff up, folks.
Here’s how prosecutors put it:
On February 18, 2025, two human resources (HR) employees of Company-1 [Opexus] scheduled a Microsoft Teams meeting with Sohaib and Muneeb. Sohaib recorded the meeting starting at 4:48pm Eastern Standard Time. The HR personnel left the meeting approximately 2 minutes and 40 seconds into the recording. Apparently unbeknownst to the defendants, the meeting continued recording the next hour of interactions between the brothers.
And what did the pair discuss? Fortunately, this obscure document gives us a much fuller picture. If you’ve ever wondered what it sounds like to be in the room while cybercriminals do their thing, it sounds something like this:
SOHAIB: “Still connected? Still on the VPN?”
SOHAIB: “Delete all their databases?”
MUNEEB: “Eh, they can recover them…backups, I’m pretty sure.”
SOHAIB: “Daily backups?”
MUNEEB: “Yup.”
SOHAIB: “What’s the plan [then]? We gonna take care of severance or are we gonna do something about…” “Should we retort to whatever they send us by saying we need $25,000 each? Hm?”
MUNEEB: “We are doing petty shit now.”
MUNEEB: “I’m going to wipe my computer clean.”
SOHAIB: “I can’t access the system but I still have the email address for their customers for eCase and FOIAXpress.”
MUNEEB and SOHAIB discuss being compensated by Company-1.
MUNEEB: “I’m not gonna threaten them shit, that’s like could be shown as some sort of . . .”
SOHAIB: “It depends on how you write it. Just say, ‘according to our previous agreement, this is the tally of the amount that I’ve been [paid], if you pay it up front, then I have no reason to communicate with customers.’”
MUNEEB: “I’m good.”
SOHAIB: “Whatcha working on man?”
MUNEEB: “Nothing important, man.”
SOHAIB: “Why won’t you tell me? I ain’t gonna snitch.”
MUNEEB: “Don’t need to. Don’t worry about it.”
MUNEEB: “People are logged out for the day, this is the perfect time.”
SOHAIB: “How do you still have access? When did you connect to their VPN?”
MUNEEB: “10 minutes before their stupid meeting.”
SOHAIB: “You might still have access to it until the end of the day. Until at least 6 hours.”
MUNEEB: “Don’t worry about it man. Don’t worry about it.”
SOHAIB: “I see you are cleaning out their database backups.”
MUNEEB: “Don’t worry about it. You don’t do nothing. Don’t try nothin’. They are looking at you, they are not looking at me.”
SOHAIB: “[G]oing to RDP into their systems and delete all their data.”
[inaudible]
SOHAIB: “The ramifications for that would be worse though.”
MUNEEB: “What are you talking about? I didn’t do nothing. They closed my access when they had that meeting.”
SOHAIB: “Alright, if you have good plausible deniability.”
SOHAIB and MUNEEB then have additional discussion about deleting backups and changing DNS information.
MUNEEB: “Eh, they can recover from yesterday. [The IT manager] will have some work to do.”
MUNEEB and SOHAIB discuss Company-1 customers, including Veteran’s Affairs OIG, Education Department OIG, DHS OIG, and customer data.
MUNEEB: “DHS was a big [customer].”
SOHAIB: “Just go into each of them and start the delete process. It will take its time. . . It will eventually delete all their files.”
MUNEEB: “Sabes, don’t say nothin’, OK, don’t worry about it.”
SOHAIB: “I ain’t sayin’ shit.”
SOHAIB: “You should have thought about it prior, man.”
MUNEEB: “What do you mean? Like had a kill script, what do you mean?”
SOHAIB: “Blackmailing them in for some money would’ve been…”
MUNEEB: “No, you do not do that. That’s proof of guilt, man.”
SOHAIB: “No but the thing was you always have your opinion, I could just communicate with their customers.”
MUNEEB: “Communicate with their customers is a different thing!”
SOHAIB: “So you’re saying these are two separate things?”
MUNEEB: “There ya go. Go say that man, go argue for that, then they’ll think you’re the one behind this shit.”
SOHAIB: “. . . They’re gonna probably raid this place.”
MUNEEB: “Eh, I’ll clean this shit up. I don’t got shit.”
SOHAIB: “We also gotta clean stuff up from the other house man.”
MUNEEB: “Get rid of that shit.”
SOHAIB: “Deleting their filesystems would be a harder fix.”
MUNEEB: “Mhhmm, especially if you clear it out.”
MUNEEB: “Everything that I did, I’m making sure it’s protected. That it’s clean.”
MUNEEB: “Don’t worry, we’ll go to Texas.”
Neither brother is currently in Texas; both are in federal prison. Sohaib was found guilty at trial last week, while Muneeb pleaded guilty in April 2026—but has been furiously trying to take back his plea ever since through a series of handwritten letters to the judge.
