U.S. Charges Russian Citizen in Phishing Campaign Using TVRAT and DarkVNC Against 80,000 Freelancers

On September 2, 2026, authorities unsealed charges against Searzhudin Tamirlanovich Aktulaev, a 40-year-old Russian citizen, for his alleged involvement in a large-scale phishing campaign targeting freelance workers.

According to an indictment returned by a federal grand jury in California, Aktulaev allegedly used 255 fake accounts to distribute Microsoft Excel files containing malicious macros. The attachments installed TVRAT and DarkVNC, malware capable of providing remote access to compromised computers and stealing credentials and personal information.

The campaign allegedly reached or compromised a total of 80,000 freelancers. Approximately half of the potential victims were located in the United States.

Fake accounts and Excel attachments used as bait

Court documents filed in June 2021 and unsealed during the week of publication describe activity carried out between June 2016 and November 2017.

The attacks targeted users of an unnamed company responsible for a technology platform for freelance work in the Northern District of California. The operation therefore exploited a setting in which exchanging documents between clients and professionals is routine.

Aktulaev allegedly created and managed 255 fake user profiles. Through these accounts, the operators sent freelancers Microsoft Excel attachments containing malicious macros.

Simply opening the spreadsheet was apparently not enough to complete the infection: the attack chain described in the indictment required the macros to be executed. Once enabled, they downloaded the malware from the Internet, allowing the attackers to take control of the system.

The authorities have not disclosed the file names, hashes, IP addresses, or domains used during the distribution phase. As a result, the public information does not support the creation of a complete list of indicators of compromise.

TVRAT and DarkVNC turned computers into remote access points

The campaign relied on two malware families with remote-control capabilities: TVRAT, also known as TeamSPy or TVSPY, and DarkVNC.

TVRAT allowed the attackers to control systems through TeamViewer. DarkVNC instead used VNC Viewer to provide similar capabilities. The use of these applications does not imply that the legitimate products were vulnerable: the charges concern malware that abused legitimate remote administration tools and protocols.

The versions of Microsoft Excel, TeamViewer, and VNC Viewer involved in the campaign have not been disclosed. No specific vulnerability has been identified, and no CVE identifier has been associated with the operation.

The attack chain relied primarily on social engineering:

1. creation of a seemingly credible account on the freelance platform;
2. contact with a professional and delivery of an Excel document;
3. execution of the macro embedded in the file;
4. download of TVRAT or DarkVNC;
5. establishment of a remote access channel;
6. transfer of stolen data to command-and-control servers.

Both malware families communicated with command-and-control, or C2, infrastructure. Thousands of computers infected with TVRAT allegedly connected to a C2 domain hosted in the United States. The domains used by the operators were reportedly paid for with virtual currency, helping limit their exposure through traditional financial records.

Credentials, personal data, and fraud risk

Remote access allowed the operators to observe or manipulate victims’ activity, search for information stored locally, and reuse active sessions on the computer.

The stolen data included e-commerce credentials and personally identifiable information, commonly referred to as PII. According to the indictment, Aktulaev and his accomplices allegedly collected and used this information for fraud and other criminal activities.

The figure of 80,000 freelancers should be interpreted cautiously. The available documentation groups together users who were reached or infected, without specifying how many merely received an attachment and how many actually executed the malware.

Approximately half of those affected were located in the United States, with a significant number in the Northern District of California. The consequences could extend beyond an individual computer: a stolen credential may enable subsequent access to online stores, professional accounts, payment systems, or connected services.

The persistence provided by remote-control tools also increased the attackers’ window of opportunity. The objective was not merely to steal a file, but to maintain a foothold on the device.

From arrest in Cyprus to federal custody

Aktulaev was arrested at Larnaca Airport in Cyprus in May 2025. He was later extradited to the United States and is now in federal custody.

His appearance before U.S. District Judge Donato is scheduled for October 5. The allegations remain charges and will be evaluated through the judicial process.

The individual counts, potential maximum sentences, and procedural status of any other alleged accomplices have not been disclosed. The identity of the affected freelance platform also remains unknown.

Separately, the U.S. Department of Justice announced a global operation conducted with international authorities and private-sector partners to dismantle the infrastructure of the Sality botnet, which is linked to Russia. However, authorities have not provided sufficient evidence to attribute any role in that botnet to Aktulaev.

No patch: defense depends on controls and threat hunting

This case does not involve a software flaw that can be fixed with an update. Consequently, there is no CVSS score, dedicated patch, or entry in CISA’s Known Exploited Vulnerabilities catalog.

For organizations that work with freelancers or routinely receive Office documents from external parties, the primary defensive measure is to restrict macro execution and inspect files before they reach employee workstations.

Administrators can look for behaviors consistent with the attack chain described above:

• Excel processes launching scripts, shells, or programs used to download files;
• unauthorized installations or executions of TeamViewer and VNC software;
• unexpected remote connections, particularly from systems that do not require remote assistance;
• persistent traffic to unknown domains or C2 infrastructure;
• newly created services, scheduled tasks, or automatic startup mechanisms;
• unusual access to e-commerce platforms after Excel attachments have been opened.

If compromise is suspected, the device should be isolated from the network and examined using up-to-date EDR or antivirus tools. Active sessions should be revoked, credentials changed from a trusted system, and any reuse of the same credentials elsewhere investigated.

The lack of specific public indicators makes simply blocking a single domain insufficient. Detection efforts should focus on behavior: macros downloading executables, unauthorized remote-control software appearing on a system, and connections inconsistent with the user’s normal activity.

A technique built around freelancers’ habits

The strength of the operation attributed to Aktulaev did not depend on a sophisticated vulnerability. Instead, it exploited a common practice: receiving documents from unfamiliar clients while evaluating a potential assignment.

The 255 fake accounts allowed the operators to multiply their contacts and quickly replace profiles that were blocked. Excel files provided a familiar delivery mechanism, while TVRAT and DarkVNC offered remote access and a platform for data theft.

The judicial response came after the arrest and extradition. From a defensive perspective, however, the case highlights a continuing weakness: when an external attachment can execute code and install remote-access tools, an ordinary work-related conversation can turn into a full system compromise.