cyber.hendryadrian.com
Security News · therecord.media

Russian National Indicted Over Malware Campaign That Infected 80,000 Users

· Original article ↗

Summary

Prosecutors allege Searzhudin Tamirlanovich Aktulaev used TVRAT and DarkVNC in a 2016–2017 campaign that infected about 80,000 users, stole credentials and personal data, and targeted a freelance employment platform.

Key points

  • Prosecutors allege Aktulaev used TVRAT, also known as TVSPY or TeamSpy, to infect about 80,000 users between June 2016 and November 2017.
  • The alleged campaign used messages from 255 fake accounts with malicious Excel attachments that prompted users to download malware.
  • The article says TVRAT exploited a TeamViewer vulnerability and DarkVNC exploited a bug in VNC Viewer to take over devices.
  • Prosecutors allege Aktulaev used the access to steal data and commit fraud; about half of the victims were in the U.S., mostly California.
  • Aktulaev was arrested in Cyprus in May 2025, extradited to the U.S., and is being held in federal custody.
  • He faces charges including conspiracy, aggravated identity theft, and transmitting code to damage a protected computer; the charges carry a maximum 20-year sentence if he is convicted.

Article Details

Event Type
Criminal indictment and extradition related to an alleged malware campaign.
Impact
Prosecutors allege that Searzhudin Tamirlanovich Aktulaev used TVRAT and DarkVNC to infect about 80,000 users, steal credentials and personal data, commit fraud, and maintain access to victims’ devices. The charges carry a maximum sentence of 20 years if he is convicted.

People

Searzhudin Tamirlanovich AktulaevIndicted in connection with the alleged 2016 malware campaign; prosecutors allege he distributed malware, stole data, and accessed victims’ devices.

Threat Actors

Searzhudin Tamirlanovich AktulaevProsecutors allege he conducted the malware campaign and used it to steal data and commit fraud.

Malware

DarkVNCProsecutors say he also used DarkVNC, stole credentials and personal data, and maintained access to victims’ devices through command-and-control domains after his arrest in Cyprus and extradition to the U.S.TVRATSearzhudin Tamirlanovich Aktulaev was indicted for running a 2016 malware campaign that used TVRAT, also known as TVSPY or TeamSpy, to infect more than 80,000 users through fake messages and malicious Excel attachments.TVSPYSearzhudin Tamirlanovich Aktulaev was indicted for running a 2016 malware campaign that used TVRAT, also known as TVSPY or TeamSpy, to infect more than 80,000 users through fake messages and malicious Excel attachments.

Products

Microsoft ExcelHe allegedly spread TVRAT through fake accounts and malicious Microsoft Excel attachments.TeamViewerTVRAT and DarkVNC exploited TeamViewer and VNC Viewer vulnerabilities to take over devices.VNC ViewerTVRAT and DarkVNC exploited TeamViewer and VNC Viewer vulnerabilities to take over devices.

Countries

CyprusProsecutors say he also used DarkVNC, stole credentials and personal data, and maintained access to victims’ devices through command-and-control domains after his arrest in Cyprus and extradition to the U.S.

Related Articles