Russian Man Extradited Over Malware Campaign Targeting Freelancers
A Russian national was extradited to the US for allegedly spreading TVRAT and DarkVNC malware to 80,000 freelance platform users via Excel attachments.
Searzhudin Tamirlanovich Aktulaev, 40, was arrested in Cyprus in May 2025, extradited on August 28, 2026, and indicted on conspiracy, computer damage, unauthorized access and aggravated identity theft charges. Prosecutors say he and co-conspirators used about 255 fake accounts on a freelance employment platform's messaging system to send macro-laden Excel attachments between June 2016 and November 2017, deploying TVRAT (TVSPY/TeamSpy) and DarkVNC remote access trojans. Thousands of victims were identified on a US-hosted C2 domain, with roughly half of the 80,000 affected users in the US; C2 infrastructure was paid for with virtual currency. If convicted he faces up to 20 years for wire fraud conspiracy plus additional terms and fines.
- Indictment cites ~255 fake platform accounts used to distribute malicious Excel macros
- TVRAT exploited a TeamViewer vulnerability; DarkVNC provided similar VNC-based remote control
- Thousands of victims found on US-hosted C2 domain; stolen data used for fraud
- Maximum penalties include 20 years for conspiracy to commit wire fraud
- Vendors
- MicrosoftTeamViewer
- Products
- ExcelTeamViewerVNC Viewer
- Threat actors
- Searzhudin Tamirlanovich Aktulaev
- Countries
- United StatesRussiaCyprus
From the original article
2 min read at infosecurity-magazine.com
Russian man extradited to US over malware campaign that targeted 80,000 freelance users
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.