Russian Hacker Indicted for Malware Attack Infecting 80,000 Freelancers

Russian national Searzhudin Tamirlanovich Aktulaev appeared in a San Francisco federal court this week to face charges related to a malware campaign that infected approximately 80,000 users of a freelance employment platform between June 2016 and November 2017. Aktulaev was arrested in Cyprus in May 2025 and extradited to the U.S. last week. The indictment, originally filed in 2021, charges him with conspiracy, aggravated identity theft, and transmission of malicious code intended to damage protected computers — offenses carrying a combined maximum sentence of 20 years in prison if convicted on all counts.

According to prosecutors, Aktulaev leveraged 255 fake user accounts on the messaging platform of an unnamed freelance tech company to distribute malicious Microsoft Excel attachments. When opened, the documents prompted victims to download a variant of the TVRAT malware (also tracked as TVSPY or TeamSpy), which exploited a vulnerability in the remote access tool TeamViewer to seize control of infected devices. He also deployed a second strain called DarkVNC, which performed the same function against VNC Viewer. Once compromised, machines communicated with command-and-control domains maintaining persistent attacker access — infrastructure that can be investigated using a WHOIS lookup to map malicious registrations.

Roughly half of the 80,000 victims were based in the United States, the majority in California. Investigators recovered a document on Aktulaev's systems containing stolen e-commerce login credentials and personal information for hundreds of victims, which he used to commit fraud and identity theft. The Justice Department has not publicly identified the targeted freelance platform, and the indictment remains sealed as of Wednesday.

Users concerned about credential exposure from similar incidents should verify their accounts using our password checker and email breach checker. Aktulaev is currently being held in federal custody, with his next court hearing scheduled for October 5.