GoKawiilRussian national indicted in US for malware campaign that hit 80,000 freelancers
A federal grand jury in California indicted 40-year-old Searzhudin Tamirlanovich Aktulaev, extradited from Cyprus in May 2025, over a phishing scheme that used 255 fake accounts to send malicious Excel attachments to roughly 80,000 freelancers on an unnamed job platform between 2016 and 2017. The attachments deployed TVRAT and DarkVNC malware, giving the defendant remote access to victims' machines and letting him steal e-commerce credentials and personal data for fraud.
GoKawiil's interpretation of the reporting above, not reported fact.
The case shows how attackers can weaponize trusted messaging features on freelance platforms to infect huge numbers of users at once, with half the victims located in the US, many in Northern California. It also highlights continued cross-border cooperation, since Aktulaev was arrested in Cyprus and extradited years after the original 2021 indictment was filed, underscoring the long tail of cybercrime prosecutions.
- Aktulaev allegedly infected about 80,000 freelancers using 255 fake accounts and malicious Excel macros.
- TVRAT and DarkVNC malware gave him remote control and exfiltrated stolen data to command-and-control servers.
- He faces trial in California after extradition from Cyprus, with a court appearance set for October 5.
Bitdefender Total Security — Phishing emails with booby-trapped Excel macros are exactly the kind of thing endpoint security is built to catch before a remote-access trojan ever lands. Bitdefender Total Security covers multiple devices with real-time malware protection and anti-phishing web filtering, a sensible layer for freelancers who open attachments from strangers all day.
See Bitdefender Total Security on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-02
Published there as: “US charges Russian for infecting 80,000 freelancers with malware”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.