Fired hacker twins forget to end Teams recording, capture own crimes - Ars Technica

Overview

Fired hacker twins forget to end Teams recording, capture own crimes

Perhaps you remember Muneeb and Sohaib Akhter, the 34-year-old twin brothers we profiled earlier this week. Although they had the tech chops to commit years of petty crimes (like stealing airline miles), what landed them in truly serious trouble was deleting 96 US government databases in the hour after both were fired last year by the same federal IT contractor, Opexus. (Opexus had just found out that both brothers had previously been in prison for cyberfraud.)

Details

The pair come off less as cybercriminal masterminds than as galumphing galoots—that is to say, a pair of bumbling oafs who thought that asking AI how to cover their tracks was going to keep them out of federal prison.

One of the minor mysteries I encountered while writing the piece was that the government had a verbatim transcript of everything the brothers said to each other during their hour-long deletion spree. The two men lived together in Arlington, Virginia, so it made sense that they might be chatting in the same room rather than by text or instant message. But how the heck had the government gotten access to the audio? Supersecret software bugging? Crazy corporate spyware running on their company laptops? FBI agent in the bushes with a microphone?

I couldn’t figure it out, and the answer didn’t appear in any of the court documents I read. But a helpful source today pointed me to the answer. It is contained within a court filing that bears the unpropitious name, “UNITED STATES’ RESPONSE IN OPPOSITION TO DEFENDANT’S MOTION TO REVOKE THE DETENTION ORDER.”

This is the kind of title that practically begs you not to read its contents. Yet the file turns out to be fascinating. And it reveals that our galumphing galoots were supersecretly recorded by… themselves.

Because they forgot to stop recording the Teams meeting in which they were fired.

On February 18, 2025, two human resources (HR) employees of Company-1 [Opexus] scheduled a Microsoft Teams meeting with Sohaib and Muneeb. Sohaib recorded the meeting starting at 4:48pm Eastern Standard Time. The HR personnel left the meeting approximately 2 minutes and 40 seconds into the recording. Apparently unbeknownst to the defendants, the meeting continued recording the next hour of interactions between the brothers.

And what did the pair discuss? Fortunately, this obscure document gives us a much fuller picture. If you’ve ever wondered what it sounds like to be in the room while cybercriminals do their thing, it sounds something like this:

SOHAIB: “Still connected? Still on the VPN?” SOHAIB: “Delete all their databases?” MUNEEB: “Eh, they can recover them…backups, I’m pretty sure.” SOHAIB: “Daily backups?” MUNEEB: “Yup.” SOHAIB: “What’s the plan [then]? We gonna take care of severance or are we gonna do something about…” “Should we retort to whatever they send us by saying we need $25,000 each? Hm?” MUNEEB: “We are doing petty shit now.” MUNEEB: “I’m going to wipe my computer clean.” SOHAIB: “I can’t access the system but I still have the email address for their customers for e Case and FOIAXpress.” MUNEEB and SOHAIB discuss being compensated by Company-1. MUNEEB: “I’m not gonna threaten them shit, that’s like could be shown as some sort of . . .” SOHAIB: “It depends on how you write it. Just say, ‘according to our previous agreement, this is the tally of the amount that I’ve been [paid], if you pay it up front, then I have no reason to communicate with customers.’” MUNEEB: “I’m good.” SOHAIB: “Whatcha working on man?” MUNEEB: “Nothing important, man.” SOHAIB: “Why won’t you tell me? I ain’t gonna snitch.” MUNEEB: “Don’t need to. Don’t worry about it.” MUNEEB: “People are logged out for the day, this is the perfect time.” SOHAIB: “How do you still have access? When did you connect to their VPN?” MUNEEB: “10 minutes before their stupid meeting.” SOHAIB: “You might still have access to it until the end of the day. Until at least 6 hours.” MUNEEB: “Don’t worry about it man. Don’t worry about it.” SOHAIB: “I see you are cleaning out their database backups.” MUNEEB: “Don’t worry about it. You don’t do nothing. Don’t try nothin’. They are looking at you, they are not looking at me.” SOHAIB: “[G]oing to RDP into their systems and delete all their data.” [inaudible] SOHAIB: “The ramifications for that would be worse though.” MUNEEB: “What are you talking about? I didn’t do nothing. They closed my access when they had that meeting.” SOHAIB: “Alright, if you have good plausible deniability.” SOHAIB and MUNEEB then have additional discussion about deleting backups and changing DNS information. MUNEEB: “Eh, they can recover from yesterday. [The IT manager] will have some work to do.” MUNEEB and SOHAIB discuss Company-1 customers, including Veteran’s Affairs OIG, Education Department OIG, DHS OIG, and customer data. MUNEEB: “DHS was a big [customer].” SOHAIB: “Just go into each of them and start the delete process. It will take its time. . . It will eventually delete all their files.” MUNEEB: “Sabes, don’t say nothin’, OK, don’t worry about it.” SOHAIB: “I ain’t sayin’ shit.” SOHAIB: “You should have thought about it prior, man.” MUNEEB: “What do you mean? Like had a kill script, what do you mean?” SOHAIB: “Blackmailing them in for some money would’ve been…” MUNEEB: “No, you do not do that. That’s proof of guilt, man.” SOHAIB: “No but the thing was you always have your opinion, I could just communicate with their customers.” MUNEEB: “Communicate with their customers is a different thing!” SOHAIB: “So you’re saying these are two separate things?” MUNEEB: “There ya go. Go say that man, go argue for that, then they’ll think you’re the one behind this shit.” SOHAIB: “. . . They’re gonna probably raid this place.” MUNEEB: “Eh, I’ll clean this shit up. I don’t got shit.” SOHAIB: “We also gotta clean stuff up from the other house man.” MUNEEB: “Get rid of that shit.” SOHAIB: “Deleting their filesystems would be a harder fix.” MUNEEB: “Mhhmm, especially if you clear it out.” MUNEEB: “Everything that I did, I’m making sure it’s protected. That it’s clean.” MUNEEB: “Don’t worry, we’ll go to Texas.”

MUNEEB: “Eh, they can recover them…backups, I’m pretty sure.”

SOHAIB: “What’s the plan [then]? We gonna take care of severance or are we gonna do something about…” “Should we retort to whatever they send us by saying we need $25,000 each? Hm?”

SOHAIB: “I can’t access the system but I still have the email address for their customers for e Case and FOIAXpress.”

MUNEEB and SOHAIB discuss being compensated by Company-1.

MUNEEB: “I’m not gonna threaten them shit, that’s like could be shown as some sort of . . .”

SOHAIB: “It depends on how you write it. Just say, ‘according to our previous agreement, this is the tally of the amount that I’ve been [paid], if you pay it up front, then I have no reason to communicate with customers.’”

SOHAIB: “Why won’t you tell me? I ain’t gonna snitch.”

MUNEEB: “People are logged out for the day, this is the perfect time.”

SOHAIB: “How do you still have access? When did you connect to their VPN?”

SOHAIB: “You might still have access to it until the end of the day. Until at least 6 hours.”

MUNEEB: “Don’t worry about it man. Don’t worry about it.”

SOHAIB: “I see you are cleaning out their database backups.”

MUNEEB: “Don’t worry about it. You don’t do nothing. Don’t try nothin’. They are looking at you, they are not looking at me.”

SOHAIB: “[G]oing to RDP into their systems and delete all their data.”

SOHAIB: “The ramifications for that would be worse though.”

MUNEEB: “What are you talking about? I didn’t do nothing. They closed my access when they had that meeting.”

SOHAIB: “Alright, if you have good plausible deniability.”

SOHAIB and MUNEEB then have additional discussion about deleting backups and changing DNS information.

MUNEEB: “Eh, they can recover from yesterday. [The IT manager] will have some work to do.”

MUNEEB and SOHAIB discuss Company-1 customers, including Veteran’s Affairs OIG, Education Department OIG, DHS OIG, and customer data.

SOHAIB: “Just go into each of them and start the delete process. It will take its time. . . It will eventually delete all their files.”

MUNEEB: “Sabes, don’t say nothin’, OK, don’t worry about it.”

SOHAIB: “You should have thought about it prior, man.”

MUNEEB: “What do you mean? Like had a kill script, what do you mean?”

SOHAIB: “Blackmailing them in for some money would’ve been…”

MUNEEB: “No, you do not do that. That’s proof of guilt, man.”

SOHAIB: “No but the thing was you always have your opinion, I could just communicate with their customers.”

MUNEEB: “Communicate with their customers is a different thing!”

SOHAIB: “So you’re saying these are two separate things?”

MUNEEB: “There ya go. Go say that man, go argue for that, then they’ll think you’re the one behind this shit.”

SOHAIB: “. . . They’re gonna probably raid this place.”

MUNEEB: “Eh, I’ll clean this shit up. I don’t got shit.”

SOHAIB: “We also gotta clean stuff up from the other house man.”

SOHAIB: “Deleting their filesystems would be a harder fix.”

MUNEEB: “Everything that I did, I’m making sure it’s protected. That it’s clean.”

Neither brother is currently in Texas; both are in federal prison. Sohaib was found guilty at trial last week, while Muneeb pleaded guilty in April 2026—but has been furiously trying to take back his plea ever since through a series of handwritten letters to the judge.

         Twin brothers wipe 96 gov't databases minutes after being fired

         Solar drone with jumbo jet wingspan broke a flight record—then it crashed

         Altman forced to confront claims at Open AI trial that he's a prolific liar

         Desperate Trump taps "Tim Apple," Jensen Huang, Elon Musk to attend Xi summit

         The newest AI boom pitch: Host a mini data center at your home

Ars Technica has been separating the signal from the noise for over 25 years. With our unique combination of technical savvy and wide-ranging interest in the technological arts and sciences, Ars is the trusted source in a sea of information. After all, you don’t need to know everything, only what’s important.

Key Takeaways

Fired hacker twins forget to end Teams recording, capture own crimes
Perhaps you remember Muneeb and Sohaib Akhter, the 34-year-old twin brothers we profiled earlier this week
The pair come off less as cybercriminal masterminds than as galumphing galoots—that is to say, a pair of bumbling oafs who thought that asking AI how to cover their tracks was going to keep them out of federal prison
One of the minor mysteries I encountered while writing the piece was that the government had a verbatim transcript of everything the brothers said to each other during their hour-long deletion spree
I couldn’t figure it out, and the answer didn’t appear in any of the court documents I read