A Russian national accused of poisoning freelance job pitches with malware-laden Excel files has been extradited from Cyprus and charged in California. Searzhudin Tamirlanovich Aktulaev, 40, appeared in federal court in San Francisco on August 31 and was ordered held in custody.
The indictment, filed in June 2021 and unsealed on his arrival, says Aktulaev and co-conspirators ran about 255 fake accounts on a well-known freelance platform and messaged roughly 80,000 users while posing as prospective clients between June 2016 and November 2017. The messages carried Excel attachments that prodded targets into enabling macros, which then pulled malware from the internet.
Two malware families are named. TVRAT abused a TeamViewer DLL-hijacking flaw to hand over remote control, while DarkVNC opened a concealed desktop for covert operation. Thousands of infected machines checked in with US-hosted command-and-control infrastructure, and about half the victims were in the United States.
Investigators recovered a C2 database listing thousands of victims and a shared document holding stolen e-commerce credentials and personal data for hundreds more. The government’s case leans on charges of wire fraud conspiracy, computer fraud, transmission of damaging code, and aggravated identity theft. Aktulaev denies the allegations, and the DoJ stresses he is presumed innocent. His next court date is October 5.
