The U.S. Department of Justice has indicted a Russian citizen, extradited from Cyprus, over a sophisticated Excel malware campaign. The suspect, Searzhudin Tamirlanovich Aktulaev, allegedly used approximately 255 fraudulent accounts on a freelance website to distribute contaminated Excel files to around 80,000 users between 2016 and 2017. This case highlights significant cybersecurity threats in the digital freelancing space.
Details of the Cybercrime Campaign
Aktulaev, aged 40, was apprehended in Cyprus in May 2025 and appeared in a San Francisco federal court on August 31. The indictment, revealed on the same day, accuses him of exploiting a “well-known freelance employment technology company” based in Northern California. The malware attack reportedly involved two types of malware, TVRAT and DarkVNC, both facilitating unauthorized access and control over infected computers.
TVRAT, a variant of the TeamViewer remote access trojan, allowed the hackers to take control of computers remotely. The malware allegedly communicated with a command-and-control server located in the U.S., affecting thousands of systems, with a significant number of victims residing in California.
Technical Aspects of the Malware
The malicious Excel files contained macros that, once enabled, downloaded the malware onto victims’ computers. TVRAT, as per the DoJ’s statement, exploited a known vulnerability in TeamViewer software, although TeamViewer has denied any inherent flaws in their system. The compromised systems transmitted stolen data back to the attackers, facilitating further criminal activities.
DarkVNC, another tool used in the campaign, creates a hidden desktop on the compromised machine, granting the attackers control without detection. This utility was first advertised on cybercriminal forums in late 2016, indicating its role in various illicit operations.
Legal Proceedings and Implications
Aktulaev faces multiple charges, including conspiracy to commit wire fraud, unauthorized computer access, and aggravated identity theft. Despite these charges, he maintains his innocence, as stated by the Russian Embassy in Cyprus. The indictment currently consists of allegations, with defendants presumed innocent until proven guilty in a court of law.
This case underscores the persistent risks that freelancing and job-seeking platforms face from cybercriminals. Recent reports indicate that these platforms continue to be targets for state-sponsored hackers, further emphasizing the need for enhanced cybersecurity measures.
As the investigation proceeds, the cybersecurity community remains vigilant, emphasizing the importance of protecting online platforms from such sophisticated threats.
