Loading story…
Russian national Searzhudin Tamirlanovich Aktulaev was extradited from Cyprus to the United States to face federal charges over an alleged 2016–2017 phishing operation that compromised more than 80,000 computers. Prosecutors allege Aktulaev and co-conspirators created roughly 255 fraudulent accounts on a freelance-employment platform and sent targets malicious Excel attachments designed to persuade them to enable macros.
The macro-enabled files allegedly downloaded the TVRAT and DarkVNC remote-access trojans, allowing the operators to steal victim information and exfiltrate it through U.S.-hosted command-and-control infrastructure. The campaign affected thousands of victims, approximately half in the United States; Aktulaev faces charges including conspiracy, computer-damage offenses, and aggravated identity theft, with potential penalties of up to 20 years in prison.
See the reporting duties and controls this puts on the clock.
7 events from the most recent confirmed update back to the earliest known activity.
The federal indictment against Aktulaev was publicly released, disclosing allegations that the operation compromised more than 80,000 computers and collected stolen data through U.S.-hosted command-and-control infrastructure.
Aktulaev appeared in federal court in San Francisco and was remanded to federal custody.
Cyprus extradited Aktulaev to the United States over the federal allegations concerning the 2016–2017 malware operation.
Aktulaev was arrested in Cyprus in connection with the alleged malware campaign.
A federal grand jury in California indicted Aktulaev on allegations including conspiracy, computer-damage offenses, unauthorized access, and aggravated identity theft.
The alleged phishing and malware distribution operation ran through November 2017, targeting approximately 80,000 platform users and infecting thousands of systems.
Aktulaev and alleged co-conspirators began using roughly 255 fraudulent freelance-platform accounts to send malicious Excel attachments. Recipients who enabled macros allegedly downloaded TVRAT or DarkVNC, enabling remote access and theft of victim data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
12 references tracked. Mallory keeps watching after this page renders.
infosec.pub
Open sourcecysecurity.news
Open sourcescworld.com
Open sourcexakep.ru
Open sourceinfosecurity-magazine.com
Open sourcetomshardware.com
Open sourcecybersecuritynews.com
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian national and web developer Sergei Anatolyevich Filimonov, 36, was extradited from the Republic of Georgia to the United States on allegations that he helped operate a bank-account takeover and wire-fraud scheme. Prosecutors allege that from November 2023 through October 2025, Filimonov and co-conspirators purchased sponsored-search advertisements, impersonated bank domains, and deployed fraudulent banking login pages to steal customer credentials and facilitate unauthorized wire transfers. The alleged operation maintained infrastructure to retain stolen credentials and gather information used to bypass bank security controls. U.S. authorities linked a December 2025 seizure of `web3adspanels.org` and its stolen-password database to at least 19 U.S. victims, about $28 million in attempted losses, and roughly $14.6 million in confirmed losses; alleged transfers involving two banks in June and November 2024 totaled nearly $6.315 million. Filimonov pleaded not guilty in the Northern District of Georgia on September 4 and remains in custody.
Sep 9, 2026
U.S. prosecutors charged Russian national **Denis Nikolayevich Obrezko** with conspiracy to commit unauthorized computer access for allegedly providing infrastructure used by the Kremlin-linked espionage group **Void Blizzard**, also tracked as **Laundry Bear**. After his transfer from Thailand to Boston, Obrezko appeared in federal court over accusations that he bought a virtual private server and internet domains through cryptocurrency transactions that enabled intrusions against U.S. and foreign targets. Thai authorities arrested him in Phuket during a joint operation with the FBI and seized laptops, mobile phones, and cryptocurrency wallets. An unsealed FBI affidavit says investigators confirmed compromises at **11 U.S. companies** between June and July 2024, while assessing that the real number of victims is likely higher. Authorities and researchers said Void Blizzard has targeted government, defense, transportation, media, healthcare, educational institutions, NGOs, critical infrastructure, and organizations across Europe, North America, NATO countries, and Ukraine, using stolen credentials, session tokens, VPNs, and U.S.-based proxy services to evade detection. The group has also been linked to spear-phishing with typosquatted Microsoft-themed domains such as `miscrsosoft[.]com` and `micsrosoftonline[.]com`, and to theft of Dutch police staff contact information.
Jun 29, 2026
A U.S. federal jury convicted Russian national **Oleg Koshkin** for operating malware crypter services that helped the **Kelihos** botnet evade antivirus detection and spread malicious payloads. Prosecutors said Koshkin ran sites including **Crypt4U.com**, **Crypt4U.net**, **fud.bz**, and **fud.re**, advertising tools that made malware such as botnets, RATs, keyloggers, stealers, crypto miners, and ransomware fully undetectable. Court evidence showed Kelihos operator **Peter Levashov** paid roughly **$3,000 per month** from 2014 to 2017 for custom high-volume re-crypting, while co-defendant **Pavel Tsurkan** pleaded guilty to aiding malware infections worldwide, including ransomware attacks. The conviction builds on the broader U.S. campaign against Kelihos, a botnet active since at least 2010 that at various points controlled **60,000 to more than 100,000 compromised Windows computers**. Authorities said the botnet was used for spam, credential theft, pump-and-dump stock fraud, denial-of-service activity, and malware distribution before the FBI and partners including **CrowdStrike** and the **Shadowserver Foundation** disrupted it through a sinkholing operation and Levashov’s arrest in Spain. Investigators linked Levashov to the infrastructure through IP and account records, with reporting noting operational security mistakes such as reused credentials that helped expose him.
Aug 15, 2026