DOJ extradites a Russian accused of pushing macro malware through 255 fake marketplace accounts
A Northern California freelance marketplace's own messaging system carried Excel macro lures to 80,000 of its users across 18 months. Microsoft closed that delivery step in 2022. The same platform lure now shows up in North Korean operations.
The Watch · Security desk
What happened
- Searzhudin Tamirlanovich Aktulaev, 40, a Russian national, was arrested at Larnaca Airport in Cyprus in May 2025, extradited to the United States on August 28, and remanded to federal custody in San Francisco on August 31.
- The indictment, filed June 1, 2021 and unsealed the day he appeared, alleges 255 fake accounts sent malicious Excel macro attachments to about 80,000 users of a Northern California freelance platform between June 2016 and November 2017.
- Two payloads are named, a TVRAT variant abusing TeamViewer and the hidden-desktop tool DarkVNC, both of which handed operators remote control and shipped stolen data to a command-and-control server.
- Thousands of TVRAT-infected machines beaconed to a command-and-control domain hosted in the United States, and roughly half of all victims were American, many of them in the district that brought the case.
- Aktulaev is scheduled to appear before U.S. District Judge Donato on October 5, and the DOJ says the indictment contains allegations only.
Why it matters
- Who's exposed exposure A marketplace that lets a fresh signup message its own user directory is operating a mail system without any of the abuse controls email spent two decades acquiring, and the contractors on it absorb the consequences.
- What it limits constraint The default macro block takes this specific chain off the shelf, so anyone reusing the channel now has to bring a payload that does not need a document to run.
- What doesn't add up contradiction DOJ calls TVRAT a TeamViewer vulnerability while TeamViewer denies one exists, and the answer determines whether the victims could ever have patched their way out or were always dependent on detection.
- What it sets up precedent A sealed indictment sat almost four years and then converted into custody on a single flight into Cyprus, which is the operating cost of travel for anyone quietly charged in San Francisco.
Next story · Security · Sep 29
Microsoft says China-linked operators hand-install NeedyMantis to keep hold of breached networksConfirmed3 publishers
Avast's April 2017 teardown of a TeamSpy sample shows where the detection problem actually sat. The macro fetched a password-protected installer that dropped legitimate, digitally signed TeamViewer binaries next to a malicious msimg32.dll, which Windows loaded in place of the real library through DLL search order hijacking; Avast noted that checking the signature on the main executable reveals nothing suspicious [26]. The library then hooked close to 50 Windows APIs so the TeamViewer window and its dialogs never appeared, and the host reported its TeamViewer ID to the C2. That ID plus a preset password is an interactive session on the machine [27].
The naming fight around that chain is not cosmetic. The DOJ release says TVRAT exploits a vulnerability in TeamViewer [23]. Kaspersky used the same word in March 2013, describing a module that "uses a vulnerability in TeamViewer v6 known as Dll-hijacking" [24]. A TeamViewer spokesman told Security Affairs in February 2017 that the company had "no evidence to assume a vulnerability of our software" [25]. Avast's description points at loading behaviour rather than a defect in the product, so there was no vendor patch for defenders to wait on, and the only reliable signals were the artifacts: a TeamViewer install nobody requested, a suppressed UI, and outbound traffic to a paid-for C2 domain [6][26][27].
The reach here comes down to simple arithmetic. 255 fake accounts, roughly 80,000 recipients, works out to about 314 messages per account across the 18 months from June 2016 to November 2017 [15][20]. That is a bulk mail run with no deliverability problem: no sending domain to get blocklisted, no target list to buy, because the platform's own user base and messaging system supplied both [4][9]. Freelancers on a hiring site open attachments from strangers because that is what the work looks like. Thousands of the infected hosts called back to a C2 domain hosted inside the United States, and about half the victims were in the country, many in the same district that indicted him [5].
The timeline is its own story. Three years and seven months separate the last alleged message from the sealed grand jury indictment [21]. Another three years and eleven months separate that filing from the airport arrest [22]. Aktulaev has denied guilt and said he was unaware of the U.S. charges, according to Russian Embassy statements in Nicosia reported by RIA Novosti and TASS [17].
A single detail pins down when the toolkit came together. DarkVNC, the hidden-desktop utility that formed the second payload, was first advertised on the Exploit forum on November 24, 2016, per eSentire, roughly five months after the campaign had already started [10][12][16]. Commodity hVNC was bolted onto a running operation. The macro step that carried both payloads has been off by default since 2022 in internet-sourced Office files [14]. The channel kept working: ESET reported in February 2025 that North Korean operators were using the same freelance-platform lure against software developers [18], and Check Point Research documented fake-recruiter campaigns last month, including a Lazarus Group wave pairing job offers with remote access malware [19].
What to watch
- Whether later filings name the freelance platform, which opens the question of what it told the 80,000 users it carried the lure to.
- The October 5 hearing before Judge Donato, for a plea, a detention ruling, and any move to charge the co-conspirators the DOJ references.
- Whether prosecutors tie the virtual-currency-funded 2016-2017 C2 infrastructure to any later crew.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence68
Perspective Coverage
6 publishers- Builder
- Builder 17%
- Operator
- Operator 78%
- Investor
- Investor 5%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Searzhudin Tamirlanovich Aktulaev, 40, a Russian national, was arrested at Larnaca Airport in Cyprus in May 2025.
- [2]
Aktulaev was extradited from Cyprus to the United States on August 28.
- [3]
He made his initial appearance in federal court in San Francisco on August 31 and was remanded to federal custody, according to the U.S. Attorney's Office for the Northern District of California.
- [4]
From at least June 2016 through November 2017, Aktulaev allegedly used roughly 255 fake user accounts on a freelance platform to send Microsoft Excel attachments with malicious macros to about 80,000 of the platform's users; the macros downloaded malware from the internet.
- [5]
Thousands of computers infected with TVRAT were calling back to a command-and-control domain hosted in the United States, and approximately half of the victims were located in the country, many in the Northern District of California.
- [6]
The DOJ said the command-and-control domains were paid for using virtual currency.
- [7]
A shared document in the email account used in the scheme contained e-commerce login credentials and personally identifiable information for hundreds of victims.
- [8]
Aktulaev is in federal custody and is scheduled to appear before U.S. District Judge Donato on October 5.
- [9]
The indictment describes the victim platform only as "a well-known freelance employment technology company" based in the Northern District of California.
- [10]
The indictment names two malware types: a variant of TVRAT, a TeamViewer remote access trojan also known as TVSPY or TeamSpy, and DarkVNC; both gave the operators remote control of the infected computer and sent stolen data to a command-and-control server.
- [11]
Aktulaev is charged with conspiracy to commit wire fraud; transmission of a program, information, code, or command to cause damage to protected computers; conspiracy to commit computer fraud; unauthorized access to a protected computer to obtain information for financial gain and to obtain value; and aggravated identity theft.
- [12]
DarkVNC is a hidden virtual network computing utility that creates a concealed desktop for the operator and was first advertised on the Exploit forum on November 24, 2016, according to a February 2024 eSentire analysis.
- [13]
The DOJ noted that the indictment contains allegations only and that Aktulaev is presumed innocent unless and until proven guilty.
- [14]
Microsoft has blocked Visual Basic for Applications macros by default since 2022 in Office files obtained from the internet on Windows devices, the delivery step this campaign relied on.
- [15]
About 80,000 recipients spread across 255 fake accounts is roughly 314 messages per account.
- [16]
DarkVNC's first forum advertisement on November 24, 2016 falls about five months after the campaign's June 2016 start.
- [17]
Aktulaev has denied guilt and said he was unaware of the U.S. charges, according to statements from the Russian Embassy in Nicosia reported by RIA Novosti and TASS earlier this year.
- [18]
ESET said in February 2025 that North Korean hackers were using the same freelance-platform lure against software developers.
- [19]
Check Point Research documented fake-recruiter campaigns last month, including a Lazarus Group wave that paired fake job offers with remote access malware.
- [20]
The alleged campaign window, June 2016 through November 2017, is 18 months.
- [21]
Three years and seven months separate the last alleged message in November 2017 from the June 1, 2021 indictment.
- [22]
Three years and eleven months separate the June 1, 2021 indictment from the May 2025 arrest in Cyprus.
- [23]
The DOJ's release says TVRAT exploits a vulnerability in TeamViewer.
- [24]
Kaspersky's March 2013 report on TeamSpy stated that the malicious module "uses a vulnerability in TeamViewer v6 known as Dll-hijacking."
- [25]
"We have no evidence to assume a vulnerability of our software," a TeamViewer spokesman told Security Affairs in February 2017.
- [26]
Avast, analyzing a TeamSpy sample spread via Excel macros in April 2017, said the macro fetched a password-protected installer bundling legitimate, digitally signed TeamViewer binaries with a malicious msimg32.dll loaded in place of the genuine Windows DLL via DLL search order hijacking, which it called clever because checking the main executable's signature reveals nothing suspicious.
- [27]
Avast said the loaded library hooks nearly 50 Windows APIs to prevent the TeamViewer window and its dialogs from being displayed, after which the infected machine reports its TeamViewer ID to a C2 server; that ID plus a preset password is enough for the operators to connect remotely.
- [28]
The indictment was filed on June 1, 2021 by a California federal grand jury and unsealed the same day as his court appearance.
Sources
6 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comUS charges Russian for infecting 80,000 freelancers with malware
1 article · September 2, 2026
- helpnetsecurity.comRussian man indicted for spreading malware to 80,000 freelancers
1 article · September 3, 2026
- infosecurity-magazine.comRussian Man Extradited Over Malware Campaign Targeting Freelancers
1 article · September 2, 2026
- scworld.comRussian national charged in US for malware scheme targeting 80,000 users
1 article · September 3, 2026
- thehackernews.comExtradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands
2 articles · September 2, 2026
- therecord.mediaRussian national facing 20 years for malware campaign that infected 80,000 freelancers
1 article · September 2, 2026
Topics and entities
Topics
- Cybercrime extradition and prosecution
- Recruitment and freelance-platform lures
- Office macro malware
- Remote Access Trojans
Entities
- Check Point Research
- Avast
- Searzhudin Tamirlanovich Aktulaev
- Lazarus Group
- Microsoft
- US Attorney's Office for the Northern District of California
- U.S. Department of Justice
- Kaspersky
- ESET