US detains Russian in freelancer malware case

A Russian national accused of helping infect about 80,000 freelance workers with malware has been extradited to the United States and placed in federal custody after appearing in court in San Francisco.

Searzhudin Tamirlanovich Aktulaev, 40, was arrested in Cyprus in May 2025 and extradited on August 28, 2026, the US Department of Justice said. He made his initial appearance in federal court on August 31, where he was remanded in custody.

A federal grand jury indictment, filed on June 1, 2021 and unsealed after his extradition, charges Aktulaev with conspiracy, transmitting malicious code to damage protected computers, unauthorised computer access and aggravated identity theft, among other offences.

Prosecutors allege that Aktulaev and unidentified co-conspirators exploited the messaging system of a well-known freelance employment technology company based in the Northern District of California to distribute malware between at least June 2016 and November 2017.

Prosecutors say the alleged campaign relied on the normal workflow of freelance marketplaces, where users routinely exchange documents while discussing jobs. The malicious spreadsheets were presented through the platform’s messaging function, giving recipients a reason to open files sent by accounts posing as legitimate users. Once the embedded macro was executed, the malware could provide remote access to the victim’s machine and transmit information outside the computer.

The indictment further alleges that the conspirators obtained value through unauthorised access and used compromised data for financial gain. Several of the computer-related counts concern access to protected computers and the theft of information, while the identity-theft allegations relate to the alleged misuse of personal data.

The indictment says the group used about 255 fake user accounts to send messages containing malicious Microsoft Excel attachments to roughly 80,000 freelance users. When recipients opened the files, they were prompted to run a macro that downloaded malware from the internet.

Two forms of malware were allegedly used. One was a variant of TVRAT, also known as TVSPY or TeamSpy, which prosecutors say enabled remote control of infected computers through the TeamViewer remote administration tool. The second, DarkVNC, performed a similar function by using VNC Viewer.

Both programs allegedly transferred stolen information from victims’ computers to command-and-control servers controlled by the conspirators. Prosecutors say the data was then collected and used to commit fraud or other criminal activity.

Court papers also allege that the command-and-control domains were paid for with virtual currency and that thousands of computers infected with TVRAT communicated with a server hosted in the United States.

About half of the victims were located in the United States, according to the indictment, with many in the Northern District of California. Investigators found a database on a command-and-control domain containing details relating to thousands of victims.

A shared document linked to an email account used in the alleged operation contained e-commerce login credentials and personally identifiable information belonging to hundreds of people, prosecutors said.

The Justice Department said the case was announced by US Attorney Craig H. Missakian and FBI Special Agent in Charge Scott R. Schelble. The investigation was conducted by the Federal Bureau of Investigation, while prosecutors from the National Security, Cyber, and Special Prosecutions Section are handling the case.

The extradition was secured by the Justice Department’s Office of International Affairs following Aktulaev’s arrest in Cyprus. His transfer to the United States brought a five-year-old sealed federal indictment into public view and allowed the prosecution to proceed in the Northern District of California.

Aktulaev is scheduled to return to district court on October 5 for a status conference before US District Judge James Donato.

The charges remain allegations, and Aktulaev is presumed innocent unless proved guilty beyond a reasonable doubt.

If convicted, he faces differing statutory maximum penalties depending on the count. The conspiracy to commit wire fraud charge carries a maximum sentence of 20 years in prison and a fine of $250,000 or twice the gross gain. A computer-damage count carries up to 10 years, while several computer-fraud and unauthorised-access offences carry maximum terms of five years.