Russian National Indicted in Alleged Malware Campaign Targeting 80,000 Freelancers
Summary
A Russian national was indicted over an alleged campaign that used fake freelance-platform accounts and malicious Excel files to infect about 80,000 users with TVRAT and DarkVNC and steal data for fraud.
Key points
- Prosecutors allege Searzhudin Tamirlanovich Aktulaev and co-conspirators created about 255 fake accounts on a freelance job platform.
- From at least June 2016 to November 2017, the accounts sent messages posing as prospective clients, with malicious Excel attachments that prompted users to run a macro.
- The campaign allegedly used TVRAT, also known as TVSPY or TeamSpy, and DarkVNC to gain remote access and steal data.
- The DOJ said stolen data was sent to command-and-control servers and used for fraud and other crimes.
- Investigators found a victim database and a document containing stolen e-commerce credentials and personal data on command-and-control infrastructure.
- Aktulaev was arrested in Cyprus in May 2025, extradited to the US in August 2026, and is in federal custody awaiting a court appearance.
Article Details
- Victim Organization
- Users targeted through a freelance employment platform; the platform is not named
- Incident Type
- Phishing campaign using malicious Excel attachments to deliver remote-access malware and steal data
- Data Types Exposed
- Stolen e-commerce credentials
- Personal data
- Affected Records
- Approximately 80,000 users were targeted; investigators recovered a database listing thousands of victims and a document containing credentials and personal data for hundreds more. The source does not confirm that all targeted users were infected or that all listed victims' data was stolen.
- Operational Impact
- Malware enabled remote control of infected machines and data theft; the stolen data was reportedly used for fraud and other crimes.
- Ransom Or Extortion
- None reported
- Claim Status
- alleged
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe DOJ said both malware families sent stolen data from victim computers to command-and-control servers.T1059.005 · Visual BasicThe malicious Excel attachments prompted users to run a macro.T1105 · Ingress Tool TransferThe macro downloaded malware from the Internet.T1204.002 · Malicious FileRecipients were prompted to open the attachments and run a macro, triggering malware download.T1219 · Remote Access ToolsTVRAT and DarkVNC reportedly provided attackers remote control of infected machines through TeamViewer and VNC Viewer.T1566.001 · Spearphishing AttachmentAttackers sent phishing messages with malicious Excel attachments posing as prospective-client communications.
People
Malware
DarkVNCThe campaign deployed TVRAT and DarkVNC to steal data from victims, including many in the US, and used the stolen information for fraud and other crimes.TVRATThe campaign deployed TVRAT and DarkVNC to steal data from victims, including many in the US, and used the stolen information for fraud and other crimes.TVSPYTVRAT, also known as TVSPY or TeamSpy, exploited a flaw in TeamViewer to hand attackers remote control of infected machines.