The Aktulaev TVRAT malware indictment has moved into federal custody after Searzhudin Tamirlanovich Aktulaev, a 40-year-old Russian national, was extradited to the United States on 28 August 2026 following his arrest at Larnaca Airport in Cyprus in May 2025. A California federal grand jury had indicted him on charges stemming from a phishing campaign that infected roughly 80,000 freelancers with remote-access malware between 2016 and 2017.
Court documents, filed in June 2021 and unsealed this week, allege that Aktulaev exploited the messaging platform of an unnamed freelance employment technology company based in the Northern District of California. Using 255 fake user accounts, he sent Microsoft Excel attachments carrying malicious macros to his targets, the macros then pulled TVRAT and DarkVNC malware down from the internet onto victims’ machines.
How the Aktulaev TVRAT malware campaign actually worked
TVRAT (also known as TeamSPy and TVSPY) hijacked victims’ systems via TeamViewer, while DarkVNC achieved the same end through VNC Viewer. Both tools gave Aktulaev and his co-conspirators remote control over infected computers, and both funnelled stolen data back to command-and-control servers.
‘Both TVRAT and DarkVNC malware sent stolen data from a victim computer to a command-and-control server, from which the stolen data was collected and used by Aktulaev and his co-conspirators to commit fraud or other criminal activity,’ the US Department of Justice said. ‘The command-and-control domains were paid for using virtual currency, and thousands of computers infected by the TVRAT malware were “calling back” to a command-and-control domain hosted in the United States.’
Beyond the remote-access tools, Aktulaev also harvested e-commerce login credentials and personally identifiable information from his victims. Investigators found that half of all infected machines belonged to users in the United States, with a concentration in the Northern District of California where the original company was based.
The campaign ran from June 2016 through November 2017, a run of well over a year during which the infrastructure was quietly sustained with cryptocurrency payments, keeping it off the more obvious payment trails.
Extradition, first appearance and what Aktulaev faces
According to Infosecurity Magazine, Aktulaev made his initial federal court appearance in San Francisco on 31 August, three days after landing on US soil. He is next scheduled to appear before US District Judge Donato on 5 October.
The sentencing exposure, if convicted, is substantial. Infosecurity Magazine reports he faces a maximum of 20 years for conspiracy to commit wire fraud, 10 years for transmitting code to damage protected computers, and two years consecutive for each aggravated identity theft count. Fines could reach $250,000 or twice the gross gain from the offences, whichever is greater.
The FBI led the investigation, with the DoJ’s Office of International Affairs handling the extradition from Cyprus, according to Infosecurity Magazine. The logistics of bringing a suspect out of a third country are rarely swift, Aktulaev’s arrest at the airport came years after the original indictment was sealed, a reminder of how long the gap between charges and custody can stretch in transnational cybercrime cases.
Separately, the US Justice Department announced on the same day that it is working to dismantle the infrastructure behind the Russian-linked Sality botnet, in a joint global action with international law enforcement and private partners. The two announcements together signal a coordinated push against legacy Russian-origin malware operations, some of which have remained active long past their original campaign windows.
Aktulaev remains in federal custody ahead of his 5 October appearance before Judge Donato, with the full indictment now public after more than four years under seal.
