Federal prosecutors in California have indicted a Russian national for allegedly deploying malicious software campaigns that targeted approximately 80,000 users on a Northern California-based freelance employment platform.
Searzhudin Tamirlanovich Aktulaev, 40, faces multiple federal charges including conspiracy, the transmission of malicious code, and aggravated identity theft, according to announcements from the United States Department of Justice. Aktulaev was initially arrested in Cyprus in May 2025 before being extradited to the United States in August 2026.
According to court documents, investigators determined that between June 2016 and November 2017, Aktulaev and his co-conspirators operated roughly 255 fake profiles on the prominent freelance portal. Masquerading as prospective employers, the fraudulent accounts messaged thousands of independent workers to initiate contact.
The Department of Justice noted that the outreach relied on malicious Microsoft Excel documents. “The messages, which were sent from approximately 255 fake user accounts, contained malicious Microsoft Excel attachments. When opened, the attachments prompted users to run a macro, which then downloaded malware from the Internet,” the agency reported.
Forensic analysis revealed that the operation leveraged two primary malware strains, designated as TVRAT—also tracked as TVSPY or TeamSpy—and DarkVNC. TVRAT exploited vulnerabilities in TeamViewer software, while DarkVNC utilized VNC Viewer to grant external operators unauthorized remote access to compromised host workstations.
The Department of Justice stated that “both TVRAT and DarkVNC malware sent stolen data from a victim computer to a command-and-control server,” which the network operators subsequently exploited for digital fraud and secondary illicit schemes. Investigators seized command-and-control infrastructure containing victim databases and shared documentation listing stolen e-commerce credentials.
Roughly half of the impacted individuals resided within the United States, with a high concentration located in the federal judicial district where the targeted freelance platform is headquartered. Aktulaev remains held in federal custody pending a scheduled district court appearance on October 5.