Russian Extradited from Cyprus: Charged in Malware Campaign Targeting 80,000 Freelancers

Searzhudin Tamirlanovich Aktulaev, 40, was extradited from Cyprus on August 28, 2026, and made his initial appearance in federal court in San Francisco three days later. The indictment, filed in June 2021 and unsealed on August 31, 2026, reconstructs a 2016–2017 malware campaign that abused trust in a freelance platform to deliver malicious Excel attachments with macros to approximately 80,000 users. The case resurfaces in 2026 not because of a novel technique, but as confirmation that international judicial cooperation can enforce accountability years after the fact.

The Attack Chain: A Trusted Platform as Vector

Aktulaev leveraged approximately 255 fake accounts on a platform described in sources as a "well-known freelance employment technology company" headquartered in the Northern District of California. The platform has not been publicly named, but the strategy is clear: weaponize a gig marketplace—where communication between clients and freelancers is expected and routine—to disguise payload delivery.

The Excel attachments contained VBA macros that, once enabled by the victim, downloaded malware from remote servers. The campaign ran for roughly 17 months, from June 2016 to November 2017. According to sources, about half the victims were located in the United States, concentrated in the Northern District of California—the same federal jurisdiction where the platform is based and where Aktulaev was prosecuted.

The figure of 80,000 recipients refers to attachments sent, not necessarily to successfully infected machines, which sources describe as "thousands." This distinction matters for impact calibration: the attack surface was broad, but conversion depended on users enabling macros.

"Both TVRAT and DarkVNC malware sent stolen data from a victim computer to a command-and-control server, from which the stolen data was collected and used by Aktulaev and his co-conspirators to commit fraud or other criminal activity" — U.S. Department of Justice, via BleepingComputer

TVRAT and DarkVNC: Two Tools, Two Modes of Control

The distributed malware consisted of TVRAT—also known as TeamSpy or TVSPY—and DarkVNC. TVRAT is a remote-access trojan built on TeamViewer. Its persistence and stealth rely on DLL hijacking: the malware drops a malicious library, msimg32.dll, which loads in place of the legitimate one during TeamViewer startup. This grants remote access without raising suspicion, since TeamViewer is legitimate, widely recognized software.

The mechanism was documented by Kaspersky in 2013 for a vulnerability in TeamViewer v6, described as DLL hijacking. TeamViewer denied the existence of a vulnerability in its software in a February 2017 statement to Security Affairs: "We have no evidence to assume a vulnerability of our software." Avast analyzed a TeamSpy sample distributed via Excel macros in 2017, confirming the DLL search-order hijacking technique with msimg32.dll and calling it "a clever technique." The technique does not require a classic vulnerability; it exploits Windows' DLL search order, a system behavior.

DarkVNC, by contrast, is an hVNC—hidden VNC—tool that lets operators control a victim's desktop invisibly to the local user. According to eSentire, DarkVNC was advertised on the Exploit forum on November 24, 2016, a date consistent with Aktulaev's campaign window. The combination of TVRAT for persistent remote access and DarkVNC for stealthy desktop interaction gave operators flexibility depending on the victim context.

From Data Theft to Monetization: Credentials and PII in Circulation

Exfiltrated data flowed to command-and-control servers. The Department of Justice, cited by BleepingComputer, stated that thousands of TVRAT-infected computers called back to a C2 domain hosted in the United States. The domains were paid for with virtual currency, according to the same source.

E-commerce credentials and personally identifiable information (PII) for hundreds of victims were found in a document shared via the email account used for the scheme. The path follows the classic structured cybercrime playbook: credential theft, aggregation in centralized repositories, reuse for subsequent fraud. Sources do not specify the exact financial damage caused or the subsequent fate of the stolen credentials.

Formal charges include conspiracy to commit wire fraud, transmission of malicious code, conspiracy to commit computer fraud, unauthorized access to obtain information for financial gain, and aggravated identity theft. Aktulaev pleaded not guilty, according to statements from the Russian Embassy in Nicosia reported by RIA Novosti and TASS. His next appearance before Judge Donato is scheduled for October 5, 2026.

Why a 2017 Campaign Matters in 2026

The resurgence of this story in 2026 is not anecdotal. It highlights three phenomena relevant to the cybersecurity sector.

First: technique longevity. Malicious VBA macros remain an active vector today, despite Microsoft blocking VBA macros by default for Office files downloaded from the internet starting in 2022. Aktulaev's campaign predates that mitigation by years, which explains its initial success but does not guarantee immunization: users can still bypass blocks, and legacy platforms may not have implemented the latest protections.

Second: weaponization of trust platforms. Freelance marketplaces are not traditional communication channels; victims do not expect phishing in an environment they chose for work, where receiving files is normal and sender identity verification is often limited to the platform's own mechanisms. Aktulaev exploited this asymmetry by creating 255 fake accounts—a volume suggesting automation and scale.

Third: judicial delay as a strategic variable. The indictment dates to 2021, the arrest to 2025, the extradition to 2026. Five years between formal charges and custody transfer, ten years since the campaign ended. This lag has implications for evidence preservation, institutional memory of victims, and the perception of impunity that can embolden similar operators.

The dossier does not specify whether identified co-conspirators have been charged, or whether stolen credentials have been recovered or neutralized. It also does not indicate whether the DLL hijacking technique used by TVRAT was later mitigated by TeamViewer in subsequent versions, or whether msimg32.dll remains a viable vector in unpatched environments.

Sources

• https://thehackernews.com/2026/09/extradited-russian-hacker-faces-charges.html
• https://www.bleepingcomputer.com/news/security/us-charges-russian-for-infecting-80-000-freelancers-with-malware/
• https://radar.offseq.com/threat/us-charges-russian-for-infecting-80000-freelancers-with-malware-85b4f60c522efd09
• https://thehackernews.com/
• https://thehackernews.com/p/upcoming-hacker-news-webinars.html
• https://thehackernews.com/search/label/Threat%20Intelligence
• https://thehackernews.com/search/label/Vulnerability

Information verified against cited sources and current as of publication.

Sources