Full Report
Plus: Instructure’s Canvas ransomware debacle comes to a close, an alleged dark net market kingpin gets arrested, OpenAI workers fall victim to a supply chain attack, and more.
Analysis Summary
# Incident Report: Opexus Revenge Hacking by Former Employees
## Executive Summary
Two brothers, Muneeb and Sohaib Akhter, engaged in a retaliatory cyberattack against their former employer, federal contractor Opexus, after being terminated. The incident resulted in the destruction of 96 government databases. Remarkably, the attackers inadvertently recorded their own criminal coordination because they failed to disconnect from a Microsoft Teams meeting hosted by the company to fire them.
## Incident Details
- **Discovery Date:** May 2026 (based on court document timeline)
- **Incident Date:** Circa 2024-2026 (Legal proceedings May 2026)
- **Affected Organization:** Opexus (Federal Contractor)
- **Sector:** Government Contracting / IT Services
- **Geography:** United States
## Timeline of Events
### Initial Access
- **Date/Time:** Immediately following termination meeting.
- **Vector:** Valid employee credentials/VPN access that had not yet been revoked.
- **Details:** The brothers remained connected to the corporate VPN and the Microsoft Teams meeting after the HR session ended.
### Lateral Movement
- **Details:** Using their existing administrative or developer access, the brothers moved from the communication platform to the database environment via the active VPN session.
### Data Exfiltration/Impact
- **Details:** The attackers deleted and destroyed 96 government databases hosted by the contractor.
### Detection & Response
- **How it was discovered:** The company discovered a recording of the termination meeting that continued to run, capturing the brothers discussing the attack in real-time ("Still on the VPN?" "Delete all their databases?").
- **Response actions taken:** Federal prosecution; both individuals pleaded guilty to hacking and wire fraud charges.
## Attack Methodology
- **Initial Access:** Valid internal accounts (insider threat).
- **Persistence:** Maintaining an active VPN session post-termination.
- **Privilege Escalation:** Likely utilized existing high-level permissions granted for their previous roles as developers/hackers for the firm.
- **Defense Evasion:** Failure to evade; the attackers accidentally recorded themselves via the company's own Teams instance.
- **Impact:** Data destruction (total deletion of 96 databases).
## Impact Assessment
- **Financial:** Significant costs associated with database recovery and potential breach of federal contracts.
- **Data Breach:** Loss of 96 government-related databases.
- **Operational:** Severe disruption to government services relying on Opexus-managed data.
- **Reputational:** Massive damage to Opexus’s standing as a secure federal contractor.
## Indicators of Compromise
- **Behavioral indicators:** Continued active VPN sessions and active meeting participation from terminated employee accounts.
- **File indicators:** Massive deletion commands executed on database clusters.
## Response Actions
- **Containment:** Revocation of credentials (belated).
- **Eradication:** Investigation of affected systems to determine the extent of the deletion.
- **Recovery:** Restoration of government databases from backups (if available).
## Lessons Learned
- **Offboarding Latency:** There was a critical failure to synchronize the HR termination with the immediate revocation of technical logical access (VPN, Teams, DB access).
- **Insider Threat Monitoring:** Employees with known criminal backgrounds (as noted in the article) pose a higher risk profile that requires stricter access control.
## Recommendations
- **Automated Offboarding:** Implement "Kill Switch" procedures where HR software triggers an automated lockout of all AD/SaaS accounts (Teams, VPN, AWS/Azure) the second a termination starts.
- **Session Termination:** Ensure that all active sessions are forcibly killed upon account deactivation.
- **Background Checks:** Stricter adherence to background check findings for employees handling sensitive government data.