Security News

Russian National Extradited Over Malware Scheme Targeting Freelance Platform Users

Infosecurity Magazine · 3 Sept 2026

Key Takeaway Treat unsolicited attachments requesting you 'enable macros' as a major red flag, even on trusted freelance or messaging platforms.

Searzhudin Tamirlanovich Aktulaev, 40, has been extradited to the United States following his arrest in Cyprus in May 2025, according to the US Department of Justice. He faces charges including conspiracy, computer damage, unauthorized access, and aggravated identity theft over his alleged role in a malware campaign that ran between 2016 and 2017.

Prosecutors allege that Aktulaev and co-conspirators created roughly 255 fake accounts on the messaging system of a major freelance employment platform, using them to send malicious Excel attachments to targeted users. Opening these files prompted victims to enable a macro, which then downloaded one of two remote access trojans — TVRAT (exploiting a TeamViewer vulnerability) or DarkVNC — giving attackers remote control of infected machines. Stolen data was allegedly sent to command-and-control servers and used to facilitate fraud and identity theft.

About half of the roughly 80,000 affected users were based in the US, with investigators recovering databases containing victim information and stolen e-commerce credentials. If convicted, Aktulaev faces decades in prison and significant fines.

malware remote access trojan phishing freelance platform identity theft

Summarised by CISO AI from Infosecurity Magazine. We link back to every original so you can read it yourself.