A Russian national has been indicted in the US for allegedly exploiting an online freelance employment platform to distribute malware to around 80,000 users worldwide and steal sensitive information for financial gain.
Searzhudin Tamirlanovich Aktulaev, 40, was arrested in Cyprus in May 2025 and extradited to the US on August 28, 2026. He made his initial appearance in federal court in San Francisco and remains in federal custody.
According to the US Department of Justice, between June 2016 and November 2017, Aktulaev and his alleged co-conspirators used around 255 fake accounts to send freelance users malicious Microsoft Excel files. Opening the attachments prompted victims to enable macros, which downloaded malware onto their computers.
Investigators allege the attackers used two forms of malware, TVRAT and DarkVNC, to remotely access infected computers and steal data, including e-commerce login credentials and personally identifiable information.
Around half of the victims were reportedly in the US, with thousands of infected computers communicating with a command-and-control server hosted in the country.
Aktulaev faces multiple charges, including conspiracy, computer fraud, causing damage to protected computers and aggravated identity theft. If convicted, he could face up to 20 years in prison on the wire-fraud conspiracy charge, along with additional sentences for other offences.
The case was investigated by the FBI and is being prosecuted by the US Department of Justice.
Aktulaev is presumed innocent unless proven guilty in court.
