Loading story…
Federal prosecutors in Virginia have filed a superseding indictment accusing brothers Muneeb Akhter and Sohaib Akhter of a new wave of cybercrime after their termination from a government contractor in February 2025. The indictment alleges the pair conspired to access company and customer systems without authorization, delete about 96 databases containing U.S. government information, steal sensitive data tied to agencies including DHS, EEOC, and the IRS, and use anti-forensic techniques to destroy evidence. Prosecutors say Muneeb Akhter copied EEOC files to a USB drive, deleted DHS-hosted data, stole IRS-related records containing federal tax information and FOIA materials, and used AI tools to obtain commands for deleting databases and clearing logs.
The filing further alleges Muneeb Akhter used roughly 5,400 stolen usernames and passwords from the EEOC Public Portal to access victims’ email, airline, hotel, and financial accounts, including through Python scripts and deceptive domains such as wardensys.com and wardensystems.com. Sohaib Akhter is separately charged with password trafficking, firearm possession as a prohibited person, and witness tampering tied to the grand jury investigation. The new case follows the brothers’ earlier federal convictions and 2015 sentencing for wire fraud and cyber intrusions involving a private company and the U.S. Department of State, where prosecutors said they stole payment-card and personal data, abused insider access to sensitive information, and attempted to establish clandestine access inside a State Department facility.
See the reporting duties and controls this puts on the clock.
9 events from the most recent confirmed update back to the earliest known activity.
The U.S. Department of Justice announced that two Virginia men were arrested for allegedly conspiring to destroy government databases. The arrests represent a new law-enforcement step in the case tied to the previously described 2025 intrusion and sabotage allegations.
The indictment alleges that Muneeb Akhter later used about 5,400 stolen usernames and passwords from the EEOC Public Portal to access victims’ email, airline, hotel, and financial accounts. Prosecutors say he used Python scripts and deceptive domains including wardensys.com and wardensystems.com in the scheme.
Prosecutors allege Muneeb Akhter used AI tools to obtain commands for deleting databases and clearing logs, and employed anti-forensic measures to destroy evidence. These actions were described in the indictment as part of the 2025 intrusion and sabotage activity.
The superseding indictment alleges that Muneeb Akhter copied EEOC files to a USB drive and stole IRS-related records containing federal tax information and FOIA materials. Prosecutors say the theft was part of a broader effort to exfiltrate sensitive government-linked data from Company-1 systems.
After their termination, prosecutors allege the brothers conspired to access Company-1 systems without authorization and damage the company and its federal agency customers. The indictment says approximately 96 databases containing U.S. government information were deleted, including DHS-hosted data.
According to the superseding indictment, Muneeb Akhter and Sohaib Akhter were terminated from government contractor Company-1 on February 18, 2025. Prosecutors allege the later 2025 offenses were carried out after their dismissal.
On October 2, 2015, the U.S. Department of Justice announced that twin brothers Muneeb and Sohaib Akhter were sentenced for wire fraud and cybercrime conspiracies involving unauthorized access to U.S. Department of State systems and a private company. Muneeb Akhter received 39 months in prison and Sohaib Akhter received 24 months, with both also ordered to serve three years of supervised release.
On 2015-06-29, Muneeb and Sohaib Akhter pleaded guilty in the Eastern District of Virginia to wire fraud and computer intrusion offenses tied to hacks involving a private company and U.S. Department of State systems. The Justice Department said the conduct included theft of customer and government data, and Sohaib admitted attempting to install a covert collection device inside a State Department building.
A superseding indictment in the Eastern District of Virginia charged Muneeb Akhter and Sohaib Akhter with computer crime, fraud, identity theft, firearms, and witness tampering offenses tied to conduct in 2025. The filing also included forfeiture allegations covering multiple laptops, phones, and external drives.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
9 references tracked. Mallory keeps watching after this page renders.
justice.gov
Open sourcejustice.gov
Open sourcejustice.gov
Open sourcejustice.gov
Open sourcestorage.courtlistener.com
Open sourcestorage.courtlistener.com
Open sourcestorage.courtlistener.com
Open sourcestorage.courtlistener.com
Open sourcestorage.courtlistener.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A federal jury convicted Virginia resident **Sohaib Akhter** for his role in a retaliatory intrusion that wiped **96 government databases** after he and his twin brother were fired from a Washington, D.C.-area software contractor supporting more than **45 U.S. federal agencies**. Prosecutors said the brothers accessed systems without authorization, write-protected and deleted databases, stole credentials, and tried to destroy evidence; the case also involved trafficking a password tied to an individual who had filed a discrimination complaint with the **Equal Employment Opportunity Commission**. Akhter was convicted of conspiracy to commit computer fraud, password trafficking, and firearm possession by a prohibited person. Court filings and reporting say the brothers also wiped company laptops, discussed preparing for a law-enforcement search, and sought ways to clear system logs after deleting a **Department of Homeland Security** database. The case drew added scrutiny because both men had previously been convicted in an earlier federal computer intrusion case involving **State Department** systems and personal data, yet were later rehired as government contractors. Sohaib Akhter faces sentencing on **September 9, 2026**, with a maximum penalty of **21 years** in prison, while his brother **Muneeb Akhter** separately faces multiple computer fraud, identity theft, and government records theft charges carrying up to **45 years**.
Jun 29, 2026
Twin brothers Muneeb and Sohaib Akhter, both former federal contractors, were arrested in Alexandria, Virginia, for allegedly conspiring to destroy and steal sensitive government data after being terminated from their positions. According to court documents, the brothers accessed computers without authorization, deleted approximately 96 databases containing U.S. government information—including records related to the Freedom of Information Act and sensitive investigative files—and attempted to cover their tracks by wiping company laptops and seeking advice from an AI tool on clearing system logs. The indictment also alleges theft of IRS data and unauthorized access to Equal Employment Opportunity Commission information, affecting at least 450 individuals. The attack targeted a government contractor, reportedly Opexus, which provides services to over 45 federal agencies, including the Department of Homeland Security, IRS, and EEOC. The Akhter brothers, who have a prior history of hacking and wire fraud convictions from 2015, allegedly carried out the data destruction and theft in a weeklong spree in February, immediately following their dismissal. The investigation involved more than 20 federal agencies and specialized units, highlighting the significant impact and scope of the insider breach.
Jun 29, 2026
Federal prosecutors in Maryland indicted former hospital pharmacist Matthew Bathula over an alleged eight-year campaign of unauthorized computer access tied to a Maryland medical system, identified in court records as **Company A** and reported to be the University of Maryland Medical Center. Investigators allege Bathula abused his role as a pharmacy clinical specialist from July 2016 through September 2024 to steal usernames, passwords, authentication cookies, images, videos, and other sensitive data from nearly 200 victims connected to the health system. According to the indictment, Bathula used keyloggers, cookie theft tools, mailbox rules, file masquerading, and later spyware to maintain covert access to employee and affiliate accounts, including **Gmail**, **Microsoft 365**, **Google Photos**, **iCloud Photos**, social media, dating apps, and home security systems. Prosecutors say the activity enabled prolonged surveillance and, between February 2023 and July 2024, included covert video recording of victims without consent; the FBI said it identified and notified 195 victims nationwide within four months. Bathula faces two counts of unauthorized access to a protected computer and one count of aggravated identity theft, with potential prison exposure of up to 17 years, while civil lawsuits by current and former employees allege negligence, negligent supervision, negligent security, and invasion of privacy.
Jun 29, 2026