A Russian national, Searzhudin Tamirlanovich Aktulaev, has been extradited from Cyprus and charged in the US for orchestrating a malware campaign in 2016–2017 that used around 255 fake accounts on a freelance platform to send malicious Excel attachments to approximately 80,000 users. The attachments tricked recipients into running macros that installed two remote access tools — TVRAT and DarkVNC — giving attackers covert control of victims' computers and enabling theft of credentials and personal data. The case highlights the ongoing abuse of freelance and job-hunting platforms as attack vectors, a tactic also currently employed by state-sponsored groups such as North Korea's Lazarus and Russia's Sandworm.
