Cybercriminal Twins Arrested After Leaving Microsoft Teams Recording On

This is a tale in which future criminal hackers and rogue employees should take note: if they decide to, say, be working in the same company and their twin brother decides to take down their very own employer’s network, they should have it at the back of their mind not to forget to end the Microsoft Teams meeting where they were fired so that it doesn’t record them talking about their acts of retaliation and vengeance.

The 34-year-old twin brothers Muneeb and Sohaib Akhter, who were workers and worked in the IT unit of the firm, accidentally videotaped their own crimes when they were fired from a Microsoft Teams conference. The error gave federal prosecutors a comprehensive, unintentional video and audio bundle that described their whole criminal scheme.

Two brothers, Muneeb and Sohaib Akhter, who also happened to be twin brothers and two hackers, had admitted and pleaded guilty to accusations that they destroyed over 96 government databases after being sacked from their positions at the federal contractor Opexus and have, hopefully, learned their lessons the hard way. And since then, Muneeb has attempted in handwritten notes to the judge to withdraw his guilty plea.

The two 34-year-old brothers’ employer took the decision by deciding to fire them after learning of their criminal histories, which included several hacking and wire fraud arrests for offenses as minor as stealing airline miles.

Only a few minutes passed during the team meeting where the two men were fired. However, the same Teams meeting that they had neglected to stop captured the hours-long, meticulous planning and implementation of their vengeance and retaliation operation, which was transcribed in a court document discovered by Ars Technica.

“Are you still connected?” Sohaib is heard asking his brother, who shared a house. “Are you still using the VPN?” “Delete every database they have.”

Muneeb declares, “We are doing petty shit now.” 

This was a major operational security failure that led to the twins’ undoing. Precisely, on the 18th day of February, 2025, HR staff at the federal IT contractor Opexus held a brief Microsoft Teams meeting to terminate the brothers after discovering their prior criminal records, which included wire fraud and stealing airline miles. At the start of the call, Sohaib Akhter manually began a recording. 

As at the time when HR had delivered the news and left the meeting in under three minutes, the twins stayed on the line. They forgot to stop the recording or exit the session. For the next hour, the platform continued recording. It captured the brothers coordinating a revenge campaign in real time from their shared Virginia residence. The recording documented their screen activity, system access, and exact conversation.

Even though the HR immediately revoked Sohaib’s system access, Muneeb’s credentials remained active for a short time, during which audio logs captured the twins executing SQL DROP commands to wipe 96 government databases and stealing over a thousand files. It also included private tax records, onto a USB drive, and debated whether to demand $25,000 each to stop the destruction.

During a digital forensics review, the investigators had found the active Teams recording on the company’s servers, and faced with undeniable video proof of their planning and actions, both brothers had pleaded guilty to federal computer damage and data theft charges.