Full Report
The U.S. Department of Justice (DoJ) has charged a Russian national, extradited from Cyprus on August 28, with using roughly 255 fake accounts on a freelance platform to send malware-laced Excel attachments to about 80,000 of its users in 2016 and 2017. Searzhudin Tamirlanovich Aktulaev, 40, was arrested in Cyprus in May 2025, the U.S. Attorney's Office for the Northern District of California
Analysis Summary
# Incident Report: Campaign targeting Freelance Platform via TVRAT and DarkVNC
## Executive Summary
Between 2016 and 2017, a Russian national and co-conspirators leveraged approximately 255 fake accounts on a prominent freelance technology platform to distribute malware to 80,000 users. The attack utilized malicious Excel macros to deploy TVRAT (TeamSpy) and DarkVNC, granting attackers full remote control over victim machines and access to sensitive PII and financial credentials. The primary suspect, Searzhudin Tamirlanovich Aktulaev, was extradited to the U.S. in August 2026 to face multiple federal charges.
## Incident Details
- **Discovery Date:** Investigation identified in June 2021 (Indictment filing); Public unsealing August 2026.
- **Incident Date:** June 2016 – November 2017
- **Affected Organization:** Unnamed "well-known freelance employment technology company"
- **Sector:** Technology / Gig Economy / Freelance Employment
- **Geography:** Headquarters in Northern District of California; Global victim base (50% in U.S.)
## Timeline of Events
### Initial Access
- **Date/Time:** June 2016
- **Vector:** Phishing via Platform Messaging
- **Details:** Attackers created ~255 fraudulent accounts on the freelance platform to send messages to 80,000 users containing malware-laced Excel attachments.
### Lateral Movement
- **Details:** While traditional internal lateral movement was not the primary focus, the malware allowed remote operators to pivot from the initial infection to access e-commerce accounts and stored credentials on the victim's local network/machine.
### Data Exfiltration/Impact
- **Details:** Attackers exfiltrated PII and e-commerce login credentials for hundreds of victims. The DarkVNC and TVRAT tools allowed for persistent remote monitoring and financial fraud.
### Detection & Response
- **Detection:** Identified through C2 traffic analysis (victims calling back to U.S.-hosted infrastructure) and long-term federal investigation.
- **Response Actions:** U.S. DOJ indictment (2021), international arrest in Cyprus (May 2025), and successful extradition to the U.S. (August 2026).
## Attack Methodology
- **Initial Access:** Social Engineering/Phishing via fraudulent freelance platform accounts.
- **Persistence:** Installation of RATs (TVRAT/DarkVNC) and password-protected installers.
- **Privilege Escalation:** Use of DLL search order hijacking.
- **Defense Evasion:** DLL hijacking (msimg32.dll) to bypass digital signature checks; API hooking (50+ Windows APIs) to hide TeamViewer windows and GUI elements from the user.
- **Credential Access:** Scraping e-commerce login credentials and PII stored on the device.
- **Discovery:** Automated C2 beacons reporting TeamViewer IDs and passwords to the attacker.
- **Lateral Movement:** Remote desktop control via hVNC (Hidden Virtual Network Computing).
- **Collection:** Gathering of PII and financial data via remote access.
- **Exfiltration:** Data sent via C2 channels to attacker-controlled domains.
- **Impact:** Financial gain through identity theft and wire fraud.
## Impact Assessment
- **Financial:** Significant, involving conspiracy to commit wire fraud and unauthorized access for financial gain.
- **Data Breach:** Compromise of PII and login credentials for hundreds of known victims; 80,000 users targeted.
- **Operational:** Disruption to the freelance platform’s ecosystem and compromise of thousands of end-user devices.
- **Reputational:** Potential impact on the freelance platform’s trust safety rating.
## Indicators of Compromise
- **Network Indicators:** C2 traffic to domains associated with TVRAT and DarkVNC (e.g., [.]com/net/org domains - defanged).
- **File Indicators:**
- Malicious Excel (.xlsm) files with VBA macros.
- Malicious `msimg32.dll` used for hijacking.
- Legitimate TeamViewer binaries used as shells.
- **Behavioral Indicators:** Unexpected TeamViewer background processes; unusual API hooking activity; hidden desktops created via VNC.
## Response Actions
- **Containment:** U.S. DOJ/FBI investigation to track C2 infrastructure.
- **Eradication:** Indictment and international arrest of the primary threat actor.
- **Recovery:** Legal proceedings and victim notification (via DOJ process).
## Lessons Learned
- **Macro Risks:** The reliance on VBA macros for initial infection highlights why Microsoft eventually moved to block them by default for internet-sourced files.
- **Platform Abuse:** Service providers must implement stricter vetting for new accounts to prevent bulk automated messaging/phishing.
- **Legitimate Tool Abuse:** Threat actors frequently repurpose legitimate software (TeamViewer, VNC) to blend in with normal administrative traffic.
## Recommendations
- **Technical Controls:** Ensure "Mark of the Web" (MOTW) protections are enforced to block macros in downloaded files.
- **Endpoint Protection:** Implement EDR solutions capable of detecting DLL search order hijacking and unauthorized API hooking.
- **Identity Management:** Encourage the use of Multi-Factor Authentication (MFA) to mitigate the impact of stolen e-commerce credentials.
- **User Training:** Educate freelance contractors on the risks of opening attachments from unverified clients/accounts.