U.S. Unseal Indictment Against Russian Citizen in Freelance Platform Phishing Case
The U.S. has unsealed an indictment against Searzhudin Aktulajev. Prosecutors allege he was involved in a campaign involving malicious Excel attachments sent to users of an unnamed freelance platform.
Aktulajev’s phishing campaign is the subject of a unsealed U.S. indictment against 40-year-old Russian citizen Searzhudin Tamirlanovich Aktulajev. On September 1, 2026, the U.S. Department of Justice (DOJ) announced that, after being detained in Cyprus, the man was extradited to the United States and appeared for the first time in federal court in San Francisco.
The indictment was originally filed on June 1, 2021. Aktulajev was detained in Cyprus in May 2025, extradited to the U.S. on August 28, 2026, and appeared in court on August 31. He remains in federal custody. The next hearing is scheduled for October 5, 2026.
Aktulajev’s phishing campaign according to the indictment
According to the indictment, the perpetrators allegedly used approximately 255 fake accounts on an unnamed online freelance-work platform from June 2016 through November 2017. Through these accounts, they allegedly sent messages with malicious Microsoft Excel attachments to approximately 80,000 users.
The attachments allegedly urged recipients to enable and run a macro. According to the DOJ, this then downloaded malware identified as TVRAT or DarkVNC. Thousands of infected computers allegedly went on to connect to command-and-control infrastructure in the U.S.
The figure of 80,000 does not represent a confirmed number of infected people or devices. It is the number of users to whom the malicious messages were allegedly sent. The DOJ announcement refers to thousands of infected computers, not 80,000 confirmed infections.
Old attack, new criminal proceedings
The case concerns a historical campaign from 2016 and 2017, not a newly discovered active threat. The DOJ did not report an unpatched vulnerability, ongoing exploitation, or a new recommendation to deploy a specific security patch.
The case also highlights the risk posed by document attachments that ask users to activate macros. This can trigger the download of malicious code directly onto a device. In this matter, however, the factual circumstances—including any alleged data theft and its possible use in fraud—remain allegations in the indictment.
Aktulajev has not been convicted and is presumed innocent. The DOJ also did not disclose the name of the freelance platform through which the messages were allegedly distributed, so the case cannot be linked to a specific service or its user base.
What happens next
The next procedural step is expected to be the hearing on October 5, 2026. Attention will also focus on whether the court or the DOJ makes the indictment itself and additional technical information about the campaign, such as indicators of compromise, available. It also remains unclear whether the allegedly abused platform will come forward and provide information to affected users.
Sources
- U.S. Department of Justice, U.S. Attorney’s Office for the Northern District of California – Confirms the unsealing of the indictment, the defendant’s identity, his extradition from Cyprus, the alleged campaign framework, the malware families used, and the date of the next hearing.
- BleepingComputer – Independently summarizes the DOJ announcement and distinguishes between attachments being sent to 80,000 users and infections affecting thousands of devices.
Verified and updated: 09/02/2026 11:29
