U.S. Indicts Russian National Over Malware Campaign Targeting 80,000 Freelancers
Summary
A California grand jury indicted Searzhudin Aktulaev over a phishing campaign that sent malicious Excel files to 80,000 freelancers and infected thousands with TVRAT and DarkVNC. U.S. authorities are also working with partners to dismantle Sality infrastructure.
Key points
- Aktulaev was indicted in California and extradited to the U.S. after his arrest in Cyprus in May 2025.
- From 2016 to 2017, he allegedly used 255 fake accounts to send macro-enabled Excel files to 80,000 freelancers; thousands were infected.
- The malware included TVRAT and DarkVNC, which enabled remote access to infected systems.
- The malware sent stolen data to command-and-control servers; victims’ e-commerce credentials and personal information were also stolen.
- The Justice Department said U.S. authorities are working with international law enforcement and private partners to dismantle Russian-linked Sality botnet infrastructure.
Article Details
- Event Type
- Indictment of a Russian national over an alleged phishing and malware campaign; separate international effort to dismantle Sality botnet infrastructure.
- Impact
- According to the indictment, Searzhudin Tamirlanovich Aktulaev used 255 fake accounts to send malicious Excel attachments to 80,000 freelancers between June 2016 and November 2017. Thousands were allegedly infected with TVRAT and DarkVNC, which enabled remote access and theft of credentials and personal information. The Department of Justice said the malware sent stolen data to command-and-control servers. U.S. authorities are also working with international law enforcement and private partners to dismantle Sality botnet infrastructure.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe Department of Justice said TVRAT and DarkVNC sent stolen data from victim computers to command-and-control servers.T1059.005 · Visual BasicThe Excel attachments contained malicious macros used to infect victims.T1105 · Ingress Tool TransferThe malicious attachments downloaded malware from the Internet onto target systems.T1219 · Remote Access ToolsThe malware provided remote control through TeamViewer and VNC Viewer.T1566.001 · Spearphishing AttachmentThe alleged campaign used phishing messages with malicious Excel attachments.
People
Threat Actors
Malware
DarkVNCused fake freelancer accounts and malicious Excel files to infect thousands of victims with TVRAT and DarkVNC.SalityThe attacks stole credentials and personal data, gave remote access to infected systems, and were part of a broader effort to dismantle the Russian-linked Sality botnet.TVRATcampaign that used fake freelancer accounts and malicious Excel files to infect thousands of victims with TVRAT and DarkVNC.TVSPY#TVRAT
Products
Microsoft ExcelBetween June 2016 and November 2017, the defendant used 255 fake user accounts to send Microsoft Excel attachments with malicious macros to 80,000 freelancers, which downloaded malware from the Internet onto theTeamViewerknown as TeamSPy and TVSPY) and DarkVNC, which gave him remote control over the infected system via TeamViewer and VNC Viewer remote administration tools, respectively.VNC Viewerand TVSPY) and DarkVNC, which gave him remote control over the infected system via TeamViewer and VNC Viewer remote administration tools, respectively.
Countries
Cyprus40-year-old Searzhudin Tamirlanovich Aktulaev was extradited to the United States after being arrested in Cyprus at Larnaca Airport in May 2025.United States40-year-old Searzhudin Tamirlanovich Aktulaev was extradited to the United States after being arrested in Cyprus at Larnaca Airport in May 2025.