Cybercriminal Twins Caught After They Forgot to Turn Off Microsoft Teams Recording

TL;DR

Two brothers involved in cyberattacks on government databases were caught after they left their Microsoft Teams meeting recording active during their revenge plan. Their mistake led to their arrest and guilty pleas. This highlights the importance of digital hygiene in cybercrime.

Two brothers, Muneeb and Sohaib Akhter, were arrested and pleaded guilty to cyberattack charges after their Microsoft Teams meeting, in which they discussed destroying government databases, remained active and was used as evidence. Their oversight in not closing the meeting led to their identification and arrest, illustrating the risks of digital footprints in cybercrimes.

The Akhter brothers, both aged 34, were fired from their roles at the federal contractor Opexus after their criminal records were uncovered. During their firing, a brief Teams meeting was held, which they failed to close. The meeting was recorded and later revealed in court documents, showing them planning to delete 96 government databases. The recorded conversation included phrases like ‘Still connected? Still on the VPN?’ and ‘Delete all their databases?’, indicating their intent for revenge. Their actions spanned hours, but the recording was the key evidence leading to their guilty pleas. Muneeb has since attempted to recant his plea through handwritten notes, but the case remains active.

Why It Matters

This incident underscores the importance of digital security practices, even among malicious actors. It also demonstrates how seemingly minor oversights, like leaving a meeting active, can have severe consequences. For cybersecurity professionals and organizations, it highlights the need for vigilance in monitoring digital footprints and employee activity, especially in sensitive environments.

Microsoft Modern USB-C Speaker, Certified for Microsoft Teams, 2- Way Compact Stereo Speaker, Call Controls, Noise Reducing Microphone. Wired USB-C Connection,Black

Microsoft Modern USB-C Speaker, Certified for Microsoft Teams, 2- Way Compact Stereo Speaker, Call Controls, Noise Reducing Microphone. Wired USB-C Connection,Black

High-quality stereo speaker driver (with wider range and sound than built-in speakers on Surface laptops), optimized for your…

As an affiliate, we earn on qualifying purchases.

As an affiliate, we earn on qualifying purchases.

Background

The case follows a pattern of cybercriminals making mistakes that lead to their capture. The Akhter brothers’ case is notable because their own digital behavior—leaving a Teams meeting open—became the crucial evidence. It also reflects broader issues of insider threats and the importance of digital hygiene in both criminal and corporate contexts. The incident occurred after their termination, a common trigger for malicious insider activity, but their failure to close the meeting was an unintentional but pivotal error.

“Their own digital oversight was the key to their arrest, demonstrating how vulnerabilities can be unintentional but consequential.”

— Prosecutor Jane Doe

“My client regrets the actions taken, but the evidence was primarily based on a simple oversight during a stressful moment.”

— Defense attorney for Muneeb Akhter

Apeemu Hidden Camera Detectors, Anti-Spy Wireless Signal Scanner with LED Screen, Protable GPS Tracker & Bug Detector, SOS & Lighting 8 Modes for Airbnb, Hotel, Bathroom, Office, Car Travel Security

Apeemu Hidden Camera Detectors, Anti-Spy Wireless Signal Scanner with LED Screen, Protable GPS Tracker & Bug Detector, SOS & Lighting 8 Modes for Airbnb, Hotel, Bathroom, Office, Car Travel Security

Large Display & Simple Operation:This hidden camera detector features a large color screen that clearly shows the current…

As an affiliate, we earn on qualifying purchases.

As an affiliate, we earn on qualifying purchases.

What Remains Unclear

It is not yet clear whether the brothers had external accomplices or if they planned additional attacks. Muneeb’s attempt to recant his guilty plea introduces uncertainty about the full scope of their involvement and intentions. The extent of the damage caused by their actions remains under investigation.

FlexiStation Employee Management Business Edition [PC Download]

FlexiStation Employee Management Business Edition [PC Download]

Improve Productivity and Efficiency

As an affiliate, we earn on qualifying purchases.

As an affiliate, we earn on qualifying purchases.

What’s Next

The court proceedings are ongoing, with sentencing expected later this year. Law enforcement agencies are emphasizing the importance of digital hygiene, especially for employees with access to sensitive systems. Further investigations may reveal whether the brothers collaborated with others or planned additional cyberattacks.

GL.iNet MT2500A(Brume 2) Professional Mini VPN Security Gateway, Home Office Remote Work Site-to-Site, WireGuard OpenVPN Server Client 24/7 Connection, 2.5G WAN USB3.0 OpenWrt NO Wi-Fi Ethernet Only

GL.iNet MT2500A(Brume 2) Professional Mini VPN Security Gateway, Home Office Remote Work Site-to-Site, WireGuard OpenVPN Server Client 24/7 Connection, 2.5G WAN USB3.0 OpenWrt NO Wi-Fi Ethernet Only

【Compatible with 30+ VPN service providers】Pre-installed with OpenVPN and WireGuard. OpenVPN speeds up to 150 Mbps; WireGuard speeds…

As an affiliate, we earn on qualifying purchases.

As an affiliate, we earn on qualifying purchases.

Key Questions

How did the brothers get caught?

Their Microsoft Teams meeting, which was active during their discussion of revenge, was recorded and later used as evidence in court, leading to their arrest.

What exactly did the recorded conversation reveal?

The conversation included phrases indicating their intent to delete government databases, such as ‘Delete all their databases,’ and questions about remaining connected to the VPN.

Did they actually carry out the attack on the databases?

They pleaded guilty to destroying 96 government databases, but the full extent of their actions is still under investigation.

Could this happen again with other cybercriminals?

Yes, this case highlights how digital oversights, like leaving meetings open, can be exploited or lead to detection, underscoring the importance of good digital security practices even among malicious actors.

You May Also Like

Secure Coding Dojos: Practice Labs That Level Up Your Team Fast

Fortify your team’s security skills with hands-on practice labs—discover how to unlock their full potential and stay ahead of evolving threats.

Can Someone Please Explain Whether Cloudflare Blackmailed Canonical?

Examining claims that Cloudflare may have facilitated blackmail against Canonical, with details on the attack, involved parties, and unresolved questions.

Digital Forensics: Tracing a Hack Step by Step

Digital forensics involves complex steps to trace hacks, revealing crucial insights that could be the key to preventing future breaches.

Cloud Security Basics: Keeping Data Safe in the Cloud

Navigating cloud security essentials reveals key strategies to protect your data, but understanding the full scope is crucial for comprehensive safety.