A Russian national has been extradited from Cyprus to the United States to face charges over an alleged phishing and malware campaign that targeted tens of thousands of users on a global freelance work platform in 2016 and 2017[1][10][14].
Prosecutors say Searzhudin Tamirlanovich Aktulaev, 40, used roughly 255 fake accounts on the platform to send malware-laced Microsoft Excel files to about 80,000 freelance workers worldwide, disguising the attachments as legitimate job-related documents[1]. The U.S. Attorney’s Office for the Northern District of California alleges that many recipients opened the files, enabling the installation of remote-access malware that gave the attacker control over their systems[1][10].
According to charging documents and technical analyses, the campaign primarily delivered the TVRAT and DarkVNC malware families, tools that provide persistent remote access and monitoring capabilities on compromised machines[4][10][15]. Security researchers note that once installed, these implants could allow the operator to steal credentials, surveil activity across freelance platforms and other online accounts, and potentially pivot into employer or client environments linked to the freelancers’ work[4][10].
Unlike recent supply-chain compromises that hinge on zero-day vulnerabilities, the freelancer-targeting operation relied on social engineering and weaponized Office documents instead of a specific software exploit, and public reports to date do not reference any CVE identifiers associated with the campaign[1][4][10]. That makes traditional patching an incomplete defense: even fully updated systems can be compromised if users are tricked into opening malicious attachments and enabling macros.
Aktulaev was arrested in Cyprus in May 2025 and extradited to the United States on August 28, 2026, following a U.S. request, before making his initial appearance in federal court in California[1]. He faces a multi-count indictment that accuses him of orchestrating the phishing operation and using the resulting access for financial gain as part of a broader cybercriminal scheme targeting freelance workers[1][10].
For organizations that rely on freelance platforms to source talent, the case underscores how attackers can exploit trust in gig-economy workflows to reach large numbers of potential victims through a single service[1][4]. Defenders should review how contractors receive and open project files, enforce policies that block or sandbox high-risk attachments such as macro-enabled Excel spreadsheets, and deploy endpoint detection tools tuned to recognize common remote-access malware families.
While the charges against Aktulaev focus on activity from 2016 and 2017, researchers warn that similar phishing schemes delivering commodity remote-access trojans remain a staple of criminal operations against freelance and small-business targets today[4][10][15]. Freelancers and platforms alike are urged to treat unsolicited attachments with caution, verify job offers and client identities out-of-band, and assume that any compromise of a contractor endpoint can quickly translate into risk for their customers and employers.
References
- Extradited Russian Hacker Faces Charges Over Excel …
- Cyber Security News – Computer Security | Hacking News …
- BleepingComputer
- Latest Russia news
- Latest Malware news
