Extradited Russian Hacker Charged Over Mass Excel Macro Campaign

Federal Charges Unsealed After Cyprus Extradition

Russian national Searzhudin Tamirlanovich Aktulaev, 40, was extradited from Cyprus on August 28 to face federal cybercrime charges in San Francisco. Following his initial appearance in the U.S. District Court for the Northern District of California on August 31, where he was remanded to federal custody, the Department of Justice unsealed a June 2021 indictment charging Aktulaev for his role in a large-scale malware distribution campaign that compromised thousands of computers between June 2016 and November 2017.

Aktulaev, who was originally arrested in Cyprus in May 2025, faces a multi-count indictment including conspiracy to commit wire fraud, transmission of a program or command to cause damage to protected computers, conspiracy to commit computer fraud, unauthorized access to a protected computer for financial gain, and aggravated identity theft. According to statements reported by RIA Novosti and TASS, Aktulaev denied guilt through the Russian Embassy in Nicosia and claimed he was unaware of the pending U.S. charges prior to his arrest.

Mechanics of the Freelance Platform Phishing Campaign

The indictment details an extensive social engineering scheme aimed at users of a major freelance employment technology company headquartered in the Northern District of California. Aktulaev and his co-conspirators operated approximately 255 fake recruiter and employer accounts on the freelancing platform to communicate directly with job seekers and contractors.

Over the 18-month operation, the actors sent malicious messages carrying Excel document attachments (.xls or .xlsm) to roughly 80,000 platform users. The attached spreadsheets relied on social engineering lures to persuade recipients into enabling Visual Basic for Applications (VBA) macros. Once a user clicked to enable macro execution, the embedded VBA code acted as a stager, downloading secondary payloads from adversary-controlled remote servers.

Thousands of victim endpoints—about half of which were located within the United States—were successfully infected. Command-and-control (C2) servers hosted in the U.S. collected stolen telemetry, system information, and e-commerce credentials. Investigators identified a shared email account used by the operators that contained personally identifiable information (PII) and login credentials belonging to hundreds of victim accounts.

Technical Analysis: TVRAT and DLL Search Order Hijacking

The campaign deployed two primary remote access payloads: a custom TeamViewer-based Remote Access Trojan known as TVRAT (also tracked as TeamSpy or TVSPY) and a hidden virtual network computing utility named DarkVNC.

TVRAT did not exploit an unpatched code execution vulnerability within TeamViewer’s core engine, but rather weaponized the software’s normal functionality through DLL search order hijacking (or DLL side-loading). When the macro dropped the malware package onto a victim’s host, it extracted a password-protected archive containing legitimate, digitally signed binaries of TeamViewer v6 along with a malicious dynamic-link library named msimg32.dll.

Because the Windows operating system historically prioritizes loading DLLs from the application’s local execution directory before searching system paths like C:\Windows\System32, the genuine TeamViewer binary loaded the malicious msimg32.dll upon startup. Once loaded in memory, the rogue DLL executed the following actions:

1. API Hooking: The DLL hooked approximately 50 Windows Application Programming Interfaces (APIs)—primarily calls associated with window rendering and process user interfaces.
2. UI Suppression: By intercepting these API calls, the malware hid all visible TeamViewer windows, taskbar icons, system tray notifications, and connection dialogs, rendering the application completely invisible to the local user.
3. C2 Exfiltration: The DLL retrieved the local instance’s generated TeamViewer ID and paired it with a hardcoded static password, exfiltrating these credentials back to the threat actor’s C2 server.

Using the stolen TeamViewer ID and preset password, the operators could initiate full interactive remote desktop sessions into victim computers without triggering user alerts or binary signature detections, as the primary running process was a legitimately signed vendor executable.

Stealth Operations via DarkVNC

In addition to TVRAT, the operators dropped DarkVNC, a hidden virtual network computing (hVNC) module that was first advertised on the underground Exploit forum in late November 2016.

Standard Virtual Network Computing (VNC) software mirrors the target system’s active display, making operator actions immediately visible on the victim’s physical screen. In contrast, hVNC utilities create an isolated, hidden secondary desktop environment within the active Windows session. This allows threat actors to open web browsers, navigate active browser sessions containing stored session cookies, drain online financial accounts, and execute shell commands entirely in the background while the legitimate user continues working on the primary desktop undisturbed.

The Persistent Threat of Job-Based Social Engineering

Freelance networks, career boards, and recruitment channels remain high-value targets for both financially motivated actors and advanced persistent threat (APT) groups. Because these platforms depend on high-volume interactions between unverified parties and frequent file exchanges (resumes, portfolios, code samples, test assignments), users operate in a high-trust, high-friction environment where downloading attachments is routine.

This campaign reflects a continuing trend across the threat landscape:

• State-Sponsored Lures: North Korean actors routinely target software developers on freelance sites to gain initial access to enterprise networks or steal cryptocurrency.
• Recruiter Impersonation: Threat groups such as Lazarus and Sandworm-linked clusters frequently initiate contact on social job networks or recruitment chat applications before pushing backdoors disguised as interview tasks, PDF readers, or custom VPN clients.

Defensive Takeaways and Mitigations

The primary delivery mechanism used in this 2016–2017 campaign—untrusted VBA macros delivered via internet-sourced Office files—has seen significant architectural mitigation in modern software environments. Since 2022, Microsoft enforces default blocking of VBA macros in files marked with the Mark of the Web (MOTW) attribute across Windows devices, preventing automatic macro execution unless explicit enterprise trust policies are configured.

To defend against DLL search order hijacking, hVNC payloads, and abuse of legitimate remote management utilities, security teams should implement the following measures:

• Restrict Unsigned DLL Loading: Configure Windows Defender Application Control (WDAC) or AppLocker policies to prevent unsigned DLLs from loading out of user-writable directories (%APPDATA%, %TEMP%, %USERPROFILE%).
• Monitor API Hooking and Process Injection: Deploy Endpoint Detection and Response (EDR) agents configured to detect API hooking targeting user32.dll and gdi32.dll functions, as well as unbacked executable memory regions within legitimate processes.
• Audit Remote Administration Tools: Maintain strict software inventory controls and flag unauthorized instances of remote desktop tools—including TeamViewer, VNC variants, and AnyDesk—executing outside sanctioned IT support paths.
• Secure Software Development: For software developers, ensure applications use SetDefaultDllDirectories and call LoadLibraryEx with LOAD_LIBRARY_SEARCH_SYSTEM32 flags to enforce safe DLL search orders and prevent local side-loading.