Russian Extradited to U.S. Over Malicious Excel Files Sent to 80,000 Freelancers

The U.S. Department of Justice has filed charges against Russian citizen Searzhudin Tamirlanovich Aktulaev, 40, who was extradited from Cyprus on August 28. According to prosecutors in the Northern District of California, in 2016–2017 he used roughly 255 fake accounts on a well-known freelance platform to send some 80,000 of its users emails carrying malicious Excel attachments.

Aktulaev was detained in Cyprus in May 2025. On August 31 he made his first appearance before a federal court in San Francisco and was taken into custody. The indictment, drawn up back on June 1, 2021, was unsealed on the day he appeared. The platform itself is not named in the document — it is described only as a “well-known technology company in the freelance-employment space” based in the Northern District of California.

How the scheme worked

The emails carried Excel attachments that prompted the recipient to run a macro. That macro, in turn, downloaded one of two pieces of malware from the internet. The first was a variant of TVRAT (also known as TVSPY or TeamSpy), a trojan built on TeamViewer. The second was DarkVNC, a hidden-VNC tool first advertised on the Exploit forum in November 2016; it creates an invisible desktop on the infected machine that the operator controls.

According to Avast, which analyzed a TeamSpy sample in 2017, the macro pulled down a password-protected installer in which legitimate signed TeamViewer files sat alongside a malicious msimg32.dll library. That library substituted itself for the system DLL by hijacking the load order — a trick made all the more convenient because a signature check on the main executable turned up nothing suspicious. The library intercepted around fifty system calls, hiding the TeamViewer windows from the victim, after which the machine reported its ID to a command-and-control server. That identifier, together with a preset password, was enough for a remote connection.

Thousands of infected computers reached out to a control domain hosted in the U.S.; about half the victims were in the country, many of them in that very district. The mailbox used in the scheme was found to contain a document with login credentials for online stores and personal details of hundreds of victims.

The charges and the context

Aktulaev is charged with conspiracy to commit wire fraud, distribution of malicious code, conspiracy to commit computer fraud, unauthorized access to protected computers, and aggravated identity theft. He denies the charges and, according to statements by the Russian embassy in Nicosia, claimed he was unaware of the accusations brought in the U.S. The Justice Department notes that an indictment is merely a set of allegations, and that the presumption of innocence applies until a verdict is reached.

The case fits a familiar pattern: freelance and job-search marketplaces remain a favorite lure for cybercriminals. It is worth adding that the lever behind this particular campaign — VBA macros — has been blocked by default by Microsoft since 2022 in Office files downloaded from the internet.

Source: The Hacker News