Extradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands

[XploitLK-Bot]

The U.S. Department of Justice (DoJ) has unsealed charges against a Russian national who was extradited from Cyprus on August 28, linking him to a widespread malware distribution campaign that targeted users of a freelance platform. The accused, Searzhudin Tamirlanovich Aktulaev, 40, allegedly weaponized roughly 255 fake accounts on the platform to send booby-trapped Excel attachments to approximately 80,000 users during 2016 and 2017.

According to the U.S. Attorney's Office for the Northern District of California, Aktulaev was arrested in Cyprus in May 2025. The indictment alleges that the malicious Excel files were designed to infect victim machines, potentially leading to unauthorized access and data theft. The scale of the operation—spanning tens of thousands of targeted users—highlights the persistent threat of social engineering via seemingly benign office documents.

• Suspect: Searzhudin Tamirlanovich Aktulaev, 40, Russian national
• Arrest Location: Cyprus (May 2025)
• Extradition Date: August 28
• Campaign Period: 2016–2017
• Attack Vector: Malware-laced Excel attachments
• Scale: ~80,000 targeted users via ~255 fake accounts

The case underscores the legal reach for cybercriminals who believe they can operate from abroad, as well as the ongoing risk posed by phishing campaigns that leverage legitimate business platforms for initial access.

Source: The Hacker News

Given that this campaign relied on fake accounts on a freelance marketplace, does your organization have controls in place to scrutinize external file deliveries from third-party platforms, or is email filtering still the primary defense?