Russian Hacker Indicted for 2016-2017 Malware Campaign Targeting Freelancers

Searzhudin Tamirlanovich Aktulaev, a 40-year-old Russian national, has been indicted for using 255 fake accounts on a freelance platform to distribute malware-laden Excel attachments to approximately 80,000 users from June 2016 to November 2017. The malware, including variants of TVRAT and DarkVNC, allowed remote access to infected computers, with many victims located in the U.S. The indictment, unsealed on September 1, 2026, details how the malware exploited vulnerabilities in popular remote administration tools. Aktulaev was arrested in Cyprus in May 2025 and extradited to the U.S. on August 28, 2026. He faces multiple charges including conspiracy to commit wire fraud and aggravated identity theft. The U.S. Attorney's Office reported that a database on the command-and-control server revealed thousands of victims and sensitive information. Aktulaev is currently in federal custody and is scheduled for a status conference on October 5, 2026.

Key Points: • Aktulaev exploited a freelance platform to distribute malware to 80,000 users. • The malware variants include TVRAT and DarkVNC, enabling remote control of infected systems. • He faces serious charges including conspiracy and aggravated identity theft.