CyberNew CyberNew
Ransomware & Malware The Record 1 month ago

Russian national facing 20 years for malware campaign that infected 80,000 freelancers

CN
CyberNew Threat Research Desk
• Original Reporting: The Record
CyberNew Threat Intel Assessment
Assessed Severity: MEDIUM
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Ransomware & Malware

Analyst Takeaway

"Image: Cottonbro via Pexels Russian national facing 20 years for malware campaign that infected 80,000 freelancers A Russian national was indicted on multiple charges related to a malware campaign he ran in 2016 that infected the devices of more than 80,000 people. Searzhudin Tamirlanovich Aktulaev appeared in a San Francisco federal court on Monday after being arrested in Cyprus in May 2025 and..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)
keyboard
Image: Cottonbro via Pexels

Russian national facing 20 years for malware campaign that infected 80,000 freelancers

A Russian national was indicted on multiple charges related to a malware campaign he ran in 2016 that infected the devices of more than 80,000 people.

Searzhudin Tamirlanovich Aktulaev appeared in a San Francisco federal court on Monday after being arrested in Cyprus in May 2025 and extradited to the U.S. last week. 

The indictment dates back to 2021, when prosecutors said Aktulaev used a variant of the “TVRAT” malware — also known as “TVSPY” or “TeamSpy.” Between June 2016 and November 2017, Aktulaev used the online messaging platform of a freelance employment tech company and spread the malware to about 80,000 of the site’s users. 

Aktulaev is facing charges of conspiracy, aggravated identity theft and transmission of a program, information, code, and command to cause damage to a protected computer, and more. The charges carry a maximum sentence of 20 years in prison if convicted. 

During his first court appearance in court this week, prosecutors said the messages Aktulaev sent came from 255 fake user accounts and contained malicious Microsoft Excel attachments.

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from The Record.

Primary Advisory →