A California federal grand jury has indicted a Russian national for his role in a phishing campaign that infected thousands of freelancers with TVRAT and DarkVNC malware.
40-year-old Searzhudin Tamirlanovich Aktulaev was extradited to the United States after being arrested in Cyprus at Larnaca Airport in May 2025.
According to court documents filed in June 2021 and unsealed this week, Aktulaev allegedly infected thousands of users of an unnamed freelance employment technology company from the Northern District of California by exploiting the online messaging platform in phishing attacks.
Between June 2016 and November 2017, the defendant used 255 fake user accounts to send Microsoft Excel attachments with malicious macros to 80,000 freelancers, which downloaded malware from the Internet onto the targets’ systems.
Throughout these attacks, Aktulaev infected his victims’ devices with TVRAT malware (also known as TeamSPy and TVSPY) and DarkVNC, which gave him remote control over the infected system via TeamViewer and VNC Viewer remote administration tools, respectively.
“Both TVRAT and DarkVNC malware sent stolen data from a victim computer to a command-and-control server, from which the stolen data was collected and used by Aktulaev and his co-conspirators to commit fraud or other criminal activity,” the Department of Justice said.
“The command-and-control domains were paid for using virtual currency, and thousands of computers infected by the TVRAT malware were ‘calling back’ to a command-and-control domain hosted in the United States.”
He also stole the victims’ e-commerce login credentials and personally identifiable information. Investigators also found that half of all infected victims were in the United States, many in the Northern District of California.
Aktulaev is now in federal custody and is scheduled to appear before U.S. District Judge Donato on October 5.
On Monday, the U.S. Justice Department also announced that it’s working to dismantle the malware infrastructure of the Russian-linked Sality botnet in a joint global action with international law enforcement and private partners.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Anthropic warns infostealer malware is hijacking Claude sessions to drain usage
New SynkLoader malware pushed in Microsoft Teams phishing campaign
Man gets six years for hacking 750 women’s Snapchat accounts
Russian hackers trojanize WebEx, Zoom apps to push Starland malware
US charges alleged operators of Russian bulletproof hosting service
Massive Microsoft 365 outage causes auth issues, service failures
Anthropic warns infostealer malware is hijacking Claude sessions to drain usage
Chrome Web Store extensions caught stealing crypto, browser data
AI-driven vulnerability discovery is accelerating. See how Action1 helps remediation keep pace.
Learn how ESET MDR can enhance your organization’s security posture
Can you trust every session? See how session enrichment enables better authentication decisions.
Pixellot discovered and secured hundreds of unmanaged AI agent identities in weeks, not months. Download the case study for how.
Identity, Data Governance & Threat Detection in One Platform: Take our In-Browser Tour
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
