A Russian national has been extradited to the United States to face federal charges over an alleged malware campaign that targeted approximately 80,000 users of a freelance employment platform.
Searzhudin Tamirlanovich Aktulaev, 40, is accused of using hundreds of fraudulent accounts to distribute malicious Microsoft Excel attachments between June 2016 and November 2017. Prosecutors allege that the attachments downloaded remote-access malware capable of controlling victims’ computers and stealing information.
The indictment was filed under seal on June 1, 2021. Aktulaev was arrested in Cyprus in May 2025 and extradited to the United States on August 28, 2026, according to the US Department of Justice.
He appeared in federal court in San Francisco on August 31 and was remanded to federal custody. The indictment was unsealed the same day.
Fake Freelance Accounts Distributed Malicious Excel Files
According to prosecutors, Aktulaev and his alleged co-conspirators exploited the messaging system of a well-known freelance employment technology company located in California’s Northern District.
The DOJ did not publicly identify the company.
The conspirators allegedly created approximately 255 fake user accounts and used them to send messages containing malicious Excel attachments to around 80,000 freelancers.
Opening an attachment prompted the recipient to enable or execute an embedded macro. If the user complied, the macro downloaded malware from the internet.
This distinction is important: the indictment alleges that malware was distributed to approximately 80,000 users, but the DOJ announcement does not establish that every recipient opened the attachment or became infected.
Freelancers can be particularly exposed to attachment-based attacks because their work routinely involves receiving documents from unfamiliar prospective clients. A spreadsheet presented as a project brief, financial record or work assignment may therefore appear consistent with an ordinary business request.
TVRAT and DarkVNC Provided Remote Access
The indictment identifies two malware families allegedly used in the campaign: TVRAT and DarkVNC.
TVRAT, also known as TVSPY or TeamSpy, incorporated or abused components associated with TeamViewer, a legitimate remote-administration product. DarkVNC provided similar hidden remote-control capabilities using Virtual Network Computing technology.
Prosecutors allege that the malware allowed the conspirators to control infected computers and transfer stolen data to command-and-control servers.
The use of recognizable remote-access components can help criminals disguise malicious activity as legitimate administrative traffic. It can also make detection more difficult when organizations permit remote-support products in their environments.
The allegations do not indicate that TeamViewer or VNC Viewer participated in the operation. The case concerns malware that allegedly misused remote-administration technology.
Thousands of Computers Connected to US-Based Infrastructure
Court allegations state that domains supporting the command-and-control infrastructure were purchased using virtual currency. At least one command-and-control domain was hosted in the United States, and thousands of computers infected with TVRAT reportedly connected back to it.
Investigators discovered a database on the command-and-control infrastructure containing information associated with thousands of victims.
The DOJ also said a shared document stored in an email account used during the alleged criminal activity contained e-commerce login credentials and personally identifiable information belonging to hundreds of people.
Prosecutors allege that information stolen through TVRAT and DarkVNC was collected from the command-and-control servers and used by Aktulaev and his co-conspirators to conduct fraud and other criminal activity.
Approximately half of the identified victims were located in the United States. The DOJ said many—not all—of those US victims were in the Northern District of California, where the federal case is being prosecuted.
Aktulaev Faces Multiple Federal Charges
The indictment charges Aktulaev with conspiracy, aggravated identity theft and transmitting code or commands that caused damage to protected computers. It also includes allegations involving wire fraud, unauthorized computer access and obtaining information or value from compromised systems.
The most serious listed offense, conspiracy to commit wire fraud, carries a maximum potential sentence of 20 years in prison. A charge involving intentional damage to protected computers carries a maximum of 10 years, while aggravated identity theft can result in a mandatory consecutive two-year sentence for each conviction.
These are maximum statutory penalties rather than a predicted sentence. Any punishment would depend on which charges, if any, result in conviction and the federal court’s consideration of applicable sentencing rules.
Aktulaev is scheduled to appear before US District Judge Donato on October 5, 2026, for a status conference.
The FBI investigated the case, which is being prosecuted by the National Security, Cyber, and Special Prosecutions Section of the US Attorney’s Office for the Northern District of California. The Justice Department’s Office of International Affairs secured the extradition from Cyprus.
The Campaign Predates Aktulaev’s Arrest
The alleged campaign operated from 2016 to 2017. The indictment was filed in 2021, approximately four years after the campaign ended—not four years after Aktulaev’s arrest.
Aktulaev was arrested in Cyprus in May 2025 and extradited more than a year later. The DOJ has not explained why the indictment remained under seal or provided details about the extradition proceedings.
Because the case is at the indictment stage, all described conduct remains an allegation. Aktulaev is presumed innocent unless prosecutors prove the charges beyond a reasonable doubt.
