Extradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands

A Russian national extradited from Cyprus now faces federal charges for orchestrating a large-scale malware campaign that targeted thousands of freelance platform users through weaponized Excel attachments.

Searzhudin Tamirlanovich Aktulaev, 40, was arrested in Cyprus in May 2025 and extradited to the United States on August 28. The U.S. Attorney's Office for the Northern District of California filed charges against him for operating approximately 255 fraudulent accounts on an unnamed freelance platform during 2016 and 2017. Prosecutors allege Aktulaev used these accounts to distribute malware-laden Excel files to roughly 80,000 platform users over this two-year period.

The campaign exploited the trust dynamics inherent to freelance marketplaces. Users typically expect legitimate work files from established contractors. Aktulaev capitalized on this assumption by creating fake accounts that appeared authentic, then embedding malicious code within Excel attachments. When victims opened these files, the embedded malware installed itself on their systems, potentially exposing sensitive data, credentials, or enabling further network compromise.

Excel-based malware delivery remained effective in 2016-2017 for a specific reason. Microsoft Office macro functionality allowed attackers to execute arbitrary code when users enabled editing on suspicious documents. Many users still disabled macro security warnings by default or failed to recognize the danger of opening unsolicited attachments. This technique required no sophisticated exploit; it relied on social engineering and user behavior rather than zero-day vulnerabilities.

The scale of the operation distinguishes this case. Targeting 80,000 users across 255 accounts suggests a coordinated, sustained effort rather than opportunistic attacks. Aktulaev maintained operational security by rotating accounts, likely to avoid detection by platform administrators. This persistence indicates either personal motivation or possible coordination with other threat actors, though the charging documents do not specify any accomplices.

The investigation spanned years. Authorities traced the malware distribution back to Aktulaev through digital forensics, payment records, or platform logs. Cyprus' cooperation in arresting and extraditing him demonstrates international cybercrime enforcement cooperation, though Cyprus is not a standard extradition partner for Russian nationals. This suggests either strong bilateral agreement or Aktulaev's presence there was coincidental.

The case carries implications for freelance platform security and user behavior. Platforms including Upwork, Fiverr, and similar services process millions of work-related files daily. If attackers can maintain hundreds of fake accounts undetected, the platforms' verification and content-scanning processes merit examination. Users remain the final line of defense. Opening unsolicited file attachments from unfamiliar contractors—regardless of platform reputation—carries inherent risk.

Charges filed in the Northern District of California suggest the malware targeted companies or individuals operating there, or the platform infrastructure itself operated from California. Federal jurisdiction requires either interstate commerce, wire fraud, or targeting of U.S. financial institutions. The scale and timeframe of this operation likely satisfied multiple jurisdictional thresholds.

Aktulaev's extradition and prosecution signal that U.S. authorities prioritize large-scale cybercriminal operations affecting American victims, even when perpetrators operate from halfway around the world. The case underscores that persistent threat actors face eventual identification and consequences, though years may pass between initial compromise and arrest.