【AI前沿】Fired hacker twins forget to end Teams recording, capture own crimes

Own goalFired hacker twins forget to end Teams recording, capture own crimesOne little mystery—solved.Nate Anderson–May 14, 2026 5:02 pm|30Credit:

      Getty ImagesCredit:

      Getty ImagesText
    settingsStory textSizeSmallStandardLargeWidth*StandardWideLinksStandardOrange* Subscribers onlyLearn moreMinimize to navPerhaps you remember Muneeb and Sohaib Akhter, the 34-year-old twin brothers weprofiled earlier this week. Although they had the tech chops to commit years of petty crimes (like stealing airline miles), what landed them in truly serious trouble was deleting 96 US government databases in the hour after both were fired last year by the same federal IT contractor, Opexus. (Opexus had just found out that both brothers had previously been in prison for cyberfraud.)The pair come off less as cybercriminal masterminds than asgalumphinggaloots—that is to say, a pair of bumbling oafs who thought that asking AI how to cover their tracks was going to keep them out of federal prison.One of the minor mysteries I encountered while writing the piece was that the government had a verbatim transcript of everything the brothers said to each other during their hour-long deletion spree. The two men lived together in Arlington, Virginia, so it made sense that they might be chatting in the same room rather than by text or instant message. But how the heck had the government gotten access to the audio? Supersecret software bugging? Crazy corporate spyware running on their company laptops? FBI agent in the bushes with a microphone?I couldn’t figure it out, and the answer didn’t appear in any of the court documents I read. But a helpful source today pointed me to the answer. It is contained within a court filing that bears the unpropitious name, “UNITED STATES’ RESPONSE IN OPPOSITION TO DEFENDANT’S MOTION TO REVOKE THE DETENTION ORDER.”This is the kind of title that practically begs younotto read its contents. Yet the file turns out to be fascinating. And it reveals that our galumphing galoots were supersecretly recorded by… themselves.On accident.Because they forgot to stop recording the Teams meeting in which they were fired.You can’t make this stuff up, folks.Here’s how prosecutors put it:On February 18, 2025, two human resources (HR) employees of Company-1 [Opexus] scheduled a Microsoft Teams meeting with Sohaib and Muneeb. Sohaib recorded the meeting starting at 4:48pm Eastern Standard Time. The HR personnel left the meeting approximately 2 minutes and 40 seconds into the recording. Apparently unbeknownst to the defendants, the meeting continued recording the next hour of interactions between the brothers.And what did the pair discuss? Fortunately, this obscure document gives us a much fuller picture. If you’ve ever wondered what it sounds like to be in the room while cybercriminals do their thing, it sounds something like this:SOHAIB:“Still connected? Still on the VPN?”SOHAIB: “Delete all their databases?”MUNEEB: “Eh, they can recover them…backups, I’m pretty sure.”SOHAIB: “Daily backups?”MUNEEB: “Yup.”SOHAIB: “What’s the plan [then]? We gonna take care of severance or are we gonna do something about…” “Should we retort to whatever they send us by saying we need $25,000 each? Hm?”MUNEEB: “We are doing petty shit now.”MUNEEB: “I’m going to wipe my computer clean.”SOHAIB: “I can’t access the system but I still have the email address for their customers for eCase and FOIAXpress.”MUNEEBandSOHAIBdiscuss being compensated by Company-1.MUNEEB: “I’m not gonna threaten them shit, that’s like could be shown as some sort of . . .”SOHAIB: “It depends on how you write it. Just say, ‘according to our previous agreement, this is the tally of the amount that I’ve been [paid], if you pay it up front, then I have no reason to communicate with customers.’”MUNEEB: “I’m good.”SOHAIB: “Whatcha working on man?”MUNEEB: “Nothing important, man.”SOHAIB: “Why won’t you tell me? I ain’t gonna snitch.”MUNEEB: “Don’t need to. Don’t worry about it.”MUNEEB: “People are logged out for the day, this is the perfect time.”SOHAIB: “How do you still have access? When did you connect to their VPN?”MUNEEB: “10 minutes before their stupid meeting.”SOHAIB: “You might still have access to it until the end of the day. Until at least 6 hours.”MUNEEB: “Don’t worry about it man. Don’t worry about it.”SOHAIB: “I see you are cleaning out their database backups.”MUNEEB: “Don’t worry about it. You don’t do nothing. Don’t try nothin’. They are looking at you, they are not looking at me.”SOHAIB: “[G]oing to RDP into their systems and delete all their data.”[inaudible]SOHAIB:“The ramifications for that would be worse though.”MUNEEB:“What are you talking about? I didn’t do nothing. They closed my access when they had that meeting.”SOHAIB:“Alright, if you have good plausible deniability.”SOHAIBandMUNEEBthen have additional discussion about deleting backups and changing DNS information.MUNEEB: “Eh, they can recover from yesterday. [T