Russian man indicted for spreading malware to 80,000 freelancers
US prosecutors indicted a Russian national for infecting roughly 80,000 freelancers with TVRAT and DarkVNC malware via fake freelance-platform accounts.
Searzhudin Tamirlanovich Aktulaev, 40, was indicted in California for conspiracy, transmission of malicious code, and aggravated identity theft; he was arrested in Cyprus in May 2025 and extradited in August 2026. From June 2016 to November 2017, about 255 fake accounts on a Northern California freelance platform messaged roughly 80,000 users with malicious Excel attachments that ran macros to download malware. The campaign deployed TVRAT (also known as TeamSpy), which exploited a TeamViewer flaw, and DarkVNC via VNC Viewer, exfiltrating stolen data to US-hosted command-and-control servers. About half the victims were in the US, and stolen credentials were used for fraud.
- Fake client accounts delivered macro-laden Excel attachments that downloaded TVRAT and DarkVNC remote access malware
- TVRAT exploited a TeamViewer flaw; DarkVNC used VNC Viewer for the same remote-control capability
- A recovered C2 database listed thousands of victims plus stolen e-commerce credentials for hundreds more
- Aktulaev remains in federal custody and is scheduled to appear in district court on October 5
- ATT&CK
- T1566.001 Spearphishing AttachmentT1204.002 Malicious FileT1219 Remote Access SoftwareT1041 Exfiltration Over C2 Channel
- Vendors
- TeamViewer
- Products
- VNC Viewer
- Countries
- United StatesRussiaCyprus
From the original article
1 min read at helpnetsecurity.com
A Russian national accused of using fake accounts on a freelance employment platform to spread malware to approximately 80,000 users has been indicted by a federal grand jury in California. Searzhudin Tamirlanovich Aktulaev, 40, faces charges of conspiracy, transmission of malicious code, and aggravated identity theft, among other counts, the Department of Justice said.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.