Russian Hacker Indicted for Using Excel Malware to Target 80,000 Freelancers With TVRAT and DarkVNC

Cybersecuritynews •Tushar Subhra Dutta • September 2, 2026

A Russian national has been indicted in the United States over an alleged malware operation that targeted roughly 80,000 freelance workers worldwide. Prosecutors say the campaign used fake accounts and booby-trapped Excel documents to turn ordinary work messages into a route for stealing data and taking control of computers. The case highlights how familiar office […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Russian Hacker Indicted for Malware Campaign Targeting 80,000 Freelancers Searzhudin Tamirlanovich Aktulaev, a 40-year-old Russian national, has been indicted for a malware campaign that infected approximately 80,000 users of a freelance employment platform between June 2016 and November 2017. The U.S. Department of Justice announced his extradition from Cyprus to the U.S. on August 28, 2026. Aktulaev allegedly used 255 fake accounts to send malicious Microsoft Excel attachments that prompted users to enable macros, which then downloaded two types of malware: TeamSpy (TVRAT) and DarkVNC. These remote access trojans allowed him to control infected computers and steal sensitive data. The indictment includes charges of conspiracy, aggravated identity theft, and unauthorized access to protected computers. If convicted, he faces a maximum sentence of over 35 years in prison. The investigation revealed that half of the victims were located in the U.S., particularly in California. 17 sources 46

Extracted Entities

Russian Hacker Indicted for Using Excel Malware to Target 80,000 Freelancers With TVRAT and DarkVNC

The full story

Extracted Entities

Attack Types (1)

Malware (2)

MITRE ATT&CK (2)