According to the U.S. Attorney's Office for the Northern District of California, Aktulaev was arrested in Cyprus in May 2025. The indictment alleges that the malicious Excel files were designed to infect victim machines, potentially leading to unauthorized access and data theft. The scale of the operation—spanning tens of thousands of targeted users—highlights the persistent threat of social engineering via seemingly benign office documents.

• Suspect: Searzhudin Tamirlanovich Aktulaev, 40, Russian national
• Arrest Location: Cyprus (May 2025)
• Extradition Date: August 28
• Campaign Period: 2016–2017
• Attack Vector: Malware-laced Excel attachments
• Scale: ~80,000 targeted users via ~255 fake accounts

The case underscores the legal reach for cybercriminals who believe they can operate from abroad, as well as the ongoing risk posed by phishing campaigns that leverage legitimate business platforms for initial access.

Source: The Hacker News

Given that this campaign relied on fake accounts on a freelance marketplace, does your organization have controls in place to scrutinize external file deliveries from third-party platforms, or is email filtering still the primary defense?