Russia hacker extradited from Cyprus to the United States

A Russian man accused of helping target about 80,000 users of a major online job platform has been extradited from Cyprus to the United States and placed in federal custody.

The defendant, identified as Searzhudin Tamirlanovich Aktulaev, was arrested in Cyprus in May 2025 and extradited to the United States on Aug. 28, 2026, according to the U.S. Department of Justice. He appeared before a federal court in San Francisco on Aug. 31 and remains detained.

The indictment alleges that the operation used about 255 fake accounts on the platform to approach thousands of users. From June 2016 to November 2017, the attackers allegedly sent Microsoft Excel files containing malware to about 80,000 people. Recipients were prompted to activate a macro, which downloaded malicious software and gave the attackers remote access to their computers.

U.S. authorities say thousands of computers became infected with TVRAT, a remote-access trojan also known as TVSPY and TeamSpy. The operation allegedly also used DarkVNC, which could create a hidden desktop on an infected computer and allow an operator to control it without the user noticing.

Data gathered by the malware was sent to a command-and-control server. The Justice Department says Aktulaev and his alleged accomplices could collect the information there and use it for fraud and other criminal activity. Investigators also found online-commerce login credentials and personal information belonging to hundreds of victims in a shared document linked to an email account involved in the operation.

Aktulaev faces charges including conspiracy to commit wire fraud, transmitting malicious code to damage protected computers, unauthorized computer access to obtain information and financial gain, and aggravated identity theft. The indictment was filed on June 1, 2021, but remained sealed until it was unsealed after his extradition.