Extradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands
Russian hacker extradited from Cyprus faces charges for a 2016-2017 campaign using fake accounts to send malware-laced Excel attachments to thousands of users.
Intelligence analysis by Qwen 2.5 (3B)
A Russian hacker extradited from Cyprus has been charged with using fake accounts to distribute malware-laced Excel attachments to about 80,000 users in 2016-2017, infecting thousands of computers with TVRAT and TeamViewer.
A Russian hacker sent fake job applications with malware-laced Excel files to thousands of people. The malware let the hacker control their computers and steal their information.
Analysis
{"heading":"The Malware Campaign","subheading":"Details of the Malware and Its Impact","paragraphs":["The hacker, Searzhudin Tamirlanovich Aktulaev, 40, was extradited from Cyprus in May 2025 and arrested in San Francisco in August 2025. The indictment alleges that he used fake accounts on a freelance employment technology company to send malware-laced Excel attachments to about 80,000 users in 2016 and 2017.","The malware, TVRAT and TeamViewer, was used to steal data from infected computers and was hosted on a C2 server in the United States. Approximately half of the victims were located in the Northern District of California.","The shared document in the email account contained e-commerce login credentials and personally identifiable information (PII) for hundreds of victims."]}
Key points
- Russian hacker extradited from Cyprus faces charges for a 2016-2017 malware campaign
- Used fake accounts on a freelance employment technology company to send malware-laced Excel attachments
- Infecting about 80,000 users with TVRAT and TeamViewer malware
- Data stolen from infected computers was hosted on a C2 server in the United States
This case may raise awareness about the risks of using unsecured freelance platforms and the importance of using strong passwords and security measures.
The case may also highlight the challenges of prosecuting hackers who operate from different countries and the need for better international cooperation in cybersecurity.
