Extradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands
US DoJ charged extradited Russian Searzhudin Aktulaev for a 2016-2017 Excel macro campaign infecting ~80,000 freelance platform users with TVRAT and DarkVNC.
Searzhudin Tamirlanovich Aktulaev, 40, was arrested in Cyprus in May 2025 and extradited to the US on August 28, facing charges including wire fraud conspiracy and aggravated identity theft. The indictment alleges ~255 fake freelance-platform accounts were used to send Excel macro attachments to about 80,000 users in 2016-2017, deploying TVRAT (TeamSpy/TVSPY) and DarkVNC RATs for remote access and data theft. Thousands of infected machines called back to a US-hosted C2 domain, with stolen credentials and PII stored in the shared email account used in the scheme.
- TVRAT used TeamViewer DLL search order hijacking (msimg32.dll) to hide connections
- DarkVNC is an hVNC tool creating a concealed desktop on victims' machines
- Delivery relied on macro-enabled Excel attachments; Microsoft blocks internet macros by default since 2022
- Defendant denies guilt; indictment originally filed June 1, 2021 and unsealed August 31
- Freelance/job-site lures also used by Lazarus Group and Sandworm-linked actors in recent campaigns
- Vendors
- TeamViewer
- Organizations
- US Department of JusticeKasperskyAvast
- Countries
- United StatesCyprus
From the original article
3 min read at thehackernews.com
The U. S. Department of Justice (DoJ) has charged a Russian national, extradited from Cyprus on August 28, with using roughly 255 fake accounts on a freelance platform to send malware-laced Excel attachments to about 80,000 of its users in 2016 and 2017.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.