A hacker who sent malicious Excel attachments a decade ago, circulating malware to 80,000 freelance workers, has finally been caught, according to federal investigators.
A grand jury had indicted a 40-year-old Russian national for a malware campaign that targeted freelance workers in 2016 and 2017, the Justice Department announced Tuesday. Searzhudin Tamirlanovich Aktulaev allegedly exploited a “well-known freelance employment technology company” in California to spread malware to approximately 80,000 users between June 2016 and November 2017.
To spread the malware, Aktulaev used about 255 fake accounts to send messages containing malicious Microsoft Excel attachments. “When opened, the attachments prompted users to run a macro, which then downloaded malware from the internet,” the Justice Department said. These Excel macros can be powerful and dangerous, as they can run a full set of automated commands, making them potent tools for secretly downloading and executing malware.
In this case, the malware involved two variants, TeamSpy and DarkVNC. Both were designed to exploit legitimate remote access software, TeamViewer and VNC Viewer, enabling a hacker to secretly access a victim’s PC and steal sensitive data.
(Credit: Avast)
In 2017, antivirus provider Avast warned about the TeamSpy campaign circulating through malicious Excel files. “When the macros are enabled by the targeted person, the infection process begins, running completely in the background, so the victim doesn’t notice anything,” Avast said at the time. In reality, the macros will download a maliciously configured version of TeamViewer that quietly acts as spyware, without tipping off the user.
“Once the machine is infected, the criminals have full access to the computer. They can steal and exfiltrate sensitive data, download and execute arbitrary programs, and more,” Avast added. Allegedly, Aktulaev and his unnamed co-conspirators used the malware to loot user data, such as logins and personal information, to commit fraud and other criminal activities.
The malicious Excel attachments likely didn’t trick all 80,000 freelance workers. Still, federal investigators discovered thousands of computers infected by the TeamSpy malware. “According to the indictment, approximately half of the victims were in the United States, many of whom were located in the Northern District of California. A database found on the command-and-control domain revealed thousands of victims,” the agency said.
Recommended by Our Editors
The indictment against Aktulaev was filed in 2021 but was finally unsealed on Monday. He was arrested in May 2025 in Cyprus. Federal investigators then successfully extradited him to the US, where Aktulaev made his initial appearance in a federal court in San Francisco on Monday.
If convicted of all the fraud and computer hacking-related charges, Aktulaev could face over 35 years in prison under a maximum sentence.
About Our Expert
Michael Kan
Principal Reporter
Experience
I’ve been a journalist for over 15 years. I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017, where I cover satellite internet services, cybersecurity, PC hardware, and more. I’m currently based in San Francisco, but previously spent over five years in China, covering the country’s technology sector.
Since 2020, I’ve covered the launch and explosive growth of SpaceX’s Starlink satellite internet service, writing 600+ stories on availability and feature launches, but also the regulatory battles over the expansion of satellite constellations, fights with rival providers like AST SpaceMobile and Amazon, and the effort to expand into satellite-based mobile service. I’ve combed through FCC filings for the latest news and driven to remote corners of California to test Starlink’s cellular service.
I also cover cyber threats, from ransomware gangs to the emergence of AI-based malware. In 2024 and 2025, the FTC forced Avast to pay consumers $16.5 million for secretly harvesting and selling their personal information to third-party clients, as revealed in my joint investigation with Motherboard.
I also cover the PC graphics card market. Pandemic-era shortages led me to camp out in front of a Best Buy to get an RTX 3000. I’m now following how the AI-driven memory shortage is impacting the entire consumer electronics market. I’m always eager to learn more, so please jump in the comments with feedback and send me tips.
Click Here For The Original Source.
