Russian Man Extradited Over Malware Campaign Targeting Freelancers
A Russian national was extradited to the US for allegedly spreading TVRAT and DarkVNC malware to 80,000 freelance platform users via Excel attachments.
Searzhudin Tamirlanovich Aktulaev, 40, was arrested in Cyprus in May 2025, extradited on August 28, 2026, and indicted on conspiracy, computer damage, unauthorized access and aggravated identity theft charges. Prosecutors say he and co-conspirators used about 255 fake accounts on a freelance employment platform's messaging system to send macro-laden Excel attachments between June 2016 and November 2017, deploying TVRAT (TVSPY/TeamSpy) and DarkVNC remote access trojans. Thousands of victims were identified on a US-hosted C2 domain, with roughly half of the 80,000 affected users in the US; C2 infrastructure was paid for with virtual currency. If convicted he faces up to 20 years for wire fraud conspiracy plus additional terms and fines.
- Indictment cites ~255 fake platform accounts used to distribute malicious Excel macros
- TVRAT exploited a TeamViewer vulnerability; DarkVNC provided similar VNC-based remote control
- Thousands of victims found on US-hosted C2 domain; stolen data used for fraud
- Maximum penalties include 20 years for conspiracy to commit wire fraud
Full article438 words · extracted from infosecurity-magazine.com · click to collapse
A Russian man has been extradited to the US over allegations that he helped distribute malware to approximately 80,000 users of a freelance employment platform between 2016 and 2017.
The US Department of Justice (DoJ) said Searzhudin Tamirlanovich Aktulaev, 40, was arrested in Cyprus in May 2025 and extradited on August 28, 2026. He made his initial federal court appearance in San Francisco on August 31 and was remanded to federal custody.
The DoJ said a federal grand jury had indicted Aktulaev on conspiracy, computer damage, unauthorized access and aggravated identity theft charges, among other offenses.
Freelance Platform Used to Distribute Malware
According to the indictment, Aktulaev and alleged co-conspirators used approximately 255 fake accounts on the messaging platform of a well-known freelance employment company in the Northern District of California to send malicious Microsoft Excel attachments between at least June 2016 and November 2017.
When opened, the attachments prompted recipients to run a macro, which then downloaded malware from the internet.
The campaign allegedly deployed two malware families. A variant of TVRAT, or TeamViewer Remote Access Trojan, also known as TVSPY or TeamSpy, exploited a vulnerability in TeamViewer to give remote control of infected computers, while DarkVNC had similar functionality through VNC Viewer.
Both remote access trojans sent stolen data to command-and-control (C2) servers, where prosecutors alleged it was collected and used for fraud and other criminal activity.
Read more on job-related scams: North Korean Fake IT Workers Leverage GitHub to Build Jobseeker Personas
The indictment said the C2 domains were paid for with virtual currency, while thousands of computers infected with TVRAT were calling back to a C2 domain hosted in the US.
Thousands of Victims Linked to Command Infrastructure
Approximately half of the victims were in the US, many of them in the Northern District of California, according to prosecutors.
A database found on the C2 domain revealed thousands of victims. A shared document on an email account used in the alleged activity contained e-commerce login credentials and personally identifiable information (PII) for hundreds more.
If convicted, Aktulaev faces a maximum of 20 years for conspiracy to commit wire fraud, 10 years for transmitting code to damage protected computers and two years consecutive for each aggravated identity theft count, alongside fines of $250,000 or twice the gross gain.
The Federal Bureau of Investigation (FBI) led the investigation and the DoJ's Office of International Affairs secured the extradition. Aktulaev remains in federal custody and is scheduled to appear for a status conference on Oct. 5.
An indictment merely alleges that crimes have been committed, and Aktulaev is presumed innocent until proven guilty beyond a reasonable doubt.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/russian-man-extradited-malware/