\n<\/p>\n
The man, Searzhudin Tamirlanovich Aktulaev, was arrested in Cyprus in May 2025 and extradited to the US on August 28, 2026, according to the US Department of Justice.<\/p>\n
Federal authorities brought Aktulaev before a federal court in San Francisco on August 31. He remains in federal custody.<\/p>\n
The Excel file trap<\/span><\/em><\/p>\n According to the indictment, the operation relied on the creation of around 255 fake accounts on the online platform. The alleged perpetrators used those accounts to approach thousands of users.<\/p>\n Between June 2016 and November 2017, they allegedly sent Microsoft Excel files containing malware to around 80,000 people.<\/p>\n The recipients were instructed to enable a macro in the file. Once activated, the macro downloaded malware from the internet, giving the attackers remote access to and control over victims\u2019 computers.<\/p>\n Thousands of computers allegedly infected<\/span><\/em><\/p>\n US authorities allege that the operation infected thousands of computers with TVRAT, a Remote Access Trojan also known as TVSPY and TeamSpy.<\/p>\n The operation allegedly also used DarkVNC, a tool capable of creating a hidden desktop environment on an infected computer. This allowed an operator to control the machine without the user\u2019s knowledge.<\/p>\n The two malware programs sent collected data to a command-and-control (C2) server. According to the Department of Justice, Aktulaev and his alleged co-conspirators could use the server to gather the information and exploit it for fraud and other criminal activities.<\/p>\n Login credentials and personal data<\/span><\/em><\/p>\n US authorities also say they found login credentials for e-commerce accounts and personal information belonging to hundreds of victims in a shared document located in an email account linked to the operation.<\/p>\n According to the indictment, the discovery supports the allegation that the attackers intended to use the stolen data for more than simply compromising computers. The information could also facilitate financial fraud and other illegal activities.<\/p>\n The charges<\/span><\/em><\/p>\n Aktulaev faces several serious charges, including conspiracy to commit wire fraud, transmission of malicious code with the intent to damage protected computers, unauthorised access to a computer to obtain information and financial gain, and aggravated identity theft.<\/p>\n A grand jury returned the indictment on June 1, 2021, but authorities kept it under seal. They unsealed it following Aktulaev\u2019s extradition to the US and his initial appearance before the federal court.<\/p>\n Aktulaev denies the charges against him.<\/span><\/em><\/p>\n According to statements from the Russian Embassy in Nicosia previously reported by Russian news agencies RIA Novosti and TASS, Aktulaev said he did not know that US authorities had a criminal case pending against him.<\/p>\n The US Department of Justice stressed that the charges in the indictment remain allegations. Aktulaev remains presumed innocent unless a court proves his guilt beyond a reasonable doubt.<\/p>\n \u00a0<\/p>\n \u00a0<\/p>\n