Fired IT Twins Forgot to Stop Teams Recording, Caught Themselves

Key Takeaways

• The Akhter twins deleted 96 US government databases within an hour of being fired from federal IT contractor Opexus
• Prosecutors obtained a verbatim transcript because the brothers forgot to stop the Teams recording from their termination meeting
• The recording captured them discussing whether backups existed and consulting AI on how to cover their tracks

When federal prosecutors charged twin brothers Muneeb and Sohaib Akhter with deleting 96 US government databases, one detail puzzled observers: the government had a word-for-word transcript of everything the twins said during their hour-long deletion spree.

The brothers lived together in Arlington, Virginia. They were chatting in the same room, not texting. So how did investigators capture the audio? Secret surveillance software? FBI agents with microphones? Corporate spyware?

The answer is simpler and more absurd. The twins recorded themselves. By accident. Because they forgot to stop the Microsoft Teams meeting from their termination call.

The Termination That Kept Recording

On February 18, 2025, two HR employees from Opexus, a federal IT contractor, scheduled a Teams meeting with both brothers. Opexus had just discovered that Muneeb and Sohaib had both previously served prison time for cyberfraud. The company was firing them.

Sohaib started recording the meeting at 4:48 PM Eastern. The HR personnel left the call about two minutes and 40 seconds later. But the recording kept running.

According to court documents, the twins apparently did not realize the meeting was still capturing audio. For the next hour, as they systematically deleted government databases, Teams recorded everything.

What the Recording Captured

The government's court filing includes snippets of the brothers' conversation. The exchanges sound less like criminal masterminds and more like people who did not think through what they were doing.

“Still connected? Still on the VPN?”

— Sohaib Akhter, captured on Teams recording

The recording shows Sohaib asking if they should delete all the databases. Muneeb's response: "Eh, they can recover them...backups, I'm pretty sure."

When Sohaib asked about daily backups, Muneeb confirmed with "Yup." The brothers then discussed whether to negotiate severance or proceed with their plan. The transcript cuts off, but the damage was already documented.

AI Could Not Save Them

The brothers reportedly asked AI tools how to cover their tracks. This did not work. Whatever suggestions they received, the fundamental problem remained: they had recorded themselves committing the crimes.

The Akhter twins were not new to cybercrime. Both had previously served prison sentences for cyberfraud. But this incident suggests their technical skills exceeded their operational security awareness by a wide margin.

The Court Filing Nobody Wanted to Read

This information comes from a court document titled "United States' Response in Opposition to Defendant's Motion to Revoke the Detention Order." That name practically begs readers to skip it. But the filing contains the most detailed account of how investigators obtained evidence against the twins.

The case remains ongoing. The brothers face federal charges for the database deletions. The accidental recording forms a central piece of the prosecution's evidence.

What This Means for IT Security

The hour-long window between termination and database deletion points to a gap in Opexus's offboarding process. Standard practice is to revoke system access before or simultaneously with termination notification. The twins retained VPN access long enough to cause significant damage.

Federal contractors handling government data face strict security requirements. This incident will likely prompt reviews of access termination procedures across similar organizations.

Frequently Asked Questions

How did investigators get a recording of the twins deleting databases?

Sohaib Akhter recorded the termination meeting via Microsoft Teams and forgot to stop the recording. It captured the next hour of conversation as the brothers deleted government databases.

How many databases did the Akhter twins delete?

The brothers deleted 96 US government databases in the hour after being fired from federal IT contractor Opexus.

Why were the twins fired from Opexus?

Opexus discovered that both brothers had previously served prison time for cyberfraud and terminated their employment.

Did the twins try to cover their tracks?

According to reports, they consulted AI tools for advice on hiding their activities. This did not help, given they had already recorded themselves committing the crimes.

Source: Ars Technica