A California federal grand jury has indicted Searzhudin Tamirlanovich Aktulaev, a 40-year-old Russian national, for running a phishing campaign that infected tens of thousands of freelancers with remote-access malware. Aktulaev was arrested at Larnaca Airport in Cyprus in May 2025 and extradited to the United States; the underlying indictment, originally filed in June 2021, was unsealed this week. Court documents allege that between June 2016 and November 2017, Aktulaev created 255 fake user accounts on an unnamed North California-based freelance platform and used them to send Microsoft Excel attachments with malicious macros to 80,000 registered freelancers. When opened, the attachments downloaded TVRAT (also known as TeamSPy or TVSPY) and DarkVNC, giving Aktulaev remote control of infected machines through TeamViewer and VNC Viewer respectively. Both tools exfiltrated stolen data to command-and-control servers paid for in cryptocurrency, and investigators found thousands of infected computers still calling back to a US-hosted C2 domain.
The stolen information included e-commerce login credentials and personally identifiable information. The Department of Justice says Aktulaev and co-conspirators used the data to commit fraud. Roughly half of all infected victims were in the United States, many in the Northern District of California. Aktulaev is currently in federal custody and is scheduled to appear before U.S. District Judge Donato on October 5.