A Russian national accused of using fake accounts on a freelance employment platform to spread malware to approximately 80,000 users has been indicted by a federal grand jury in California.
Searzhudin Tamirlanovich Aktulaev, 40, faces charges of conspiracy, transmission of malicious code, and aggravated identity theft, among other counts, the Department of Justice said. He was arrested in Cyprus in May 2025 and extradited to the US in August 2026.
From at least June 2016 through November 2017, Aktulaev and his co-conspirators built around 255 fake accounts on a well-known freelance work platform headquartered in Northern California. They used those accounts to message roughly 80,000 users, posing as prospective clients.
“The messages, which were sent from approximately 255 fake user accounts, contained malicious Microsoft Excel attachments. When opened, the attachments prompted users to run a macro, which then downloaded malware from the Internet ,” US DoJ wrote.
According to the indictment, the campaign deployed two malware families. TVRAT, also known as TVSPY or TeamSpy, exploited a flaw in TeamViewer to hand attackers remote control of infected machines. DarkVNC pulled off the same trick through VNC Viewer.
“Both TVRAT and DarkVNC malware sent stolen data from a victim computer to a command-and-control server,” the DOJ said, adding that Aktulaev and his co-conspirators used that data to commit fraud and other crimes. Domain payments were made in virtual currency, and thousands of compromised machines checked in with infrastructure hosted in the US.
Half the victims were in the US, many in the same Northern California district where the platform is based. Investigators also recovered a database on the command-and-control server listing thousands of victims, along with a shared document holding stolen e-commerce credentials and personal data for hundreds more.
Aktulaev is in federal custody and is scheduled to appear in district court on October 5.
