Extradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands
Russian national Searzhudin Tamirlanovich Aktulaev charged with using ~255 fake freelance platform accounts to distribute malware-laced Excel attachments to ~80,000 users in 2016–2017 Two malware variants deployed: TVRAT (TeamViewer-based RAT exploiting DLL search order hijacking) and DarkVNC (hidden VNC utility), both providing remote access and data exfiltration Attack chain relied on Excel macro execution to download and install malicious payloads, with stolen credentials and PII harvested vi
Analysis
TL;DR
- Russian national Searzhudin Tamirlanovich Aktulaev charged with using ~255 fake freelance platform accounts to distribute malware-laced Excel attachments to ~80,000 users in 2016–2017
- Two malware variants deployed: TVRAT (TeamViewer-based RAT exploiting DLL search order hijacking) and DarkVNC (hidden VNC utility), both providing remote access and data exfiltration
- Attack chain relied on Excel macro execution to download and install malicious payloads, with stolen credentials and PII harvested via a U.S.-hosted C2 server
- Freelance/job-platform phishing remains a persistent vector, with recent state-sponsored campaigns (Lazarus Group, Sandworm, North Korean actors) employing similar recruiter lures
- Microsoft has since blocked VBA macros by default for internet-sourced Office files on Windows, effectively closing the primary delivery mechanism used in this campaign
Why It Matters
This case illustrates the enduring effectiveness of social engineering via professional platforms as an attack vector, bridging both cybercrime and state-sponsored threat activity. For security practitioners, it underscores the importance of monitoring freelance and job-hunting platforms for malicious actor infiltration and reinforcing macro security policies. The case also highlights how legacy techniques like DLL hijacking remain viable when combined with legitimate software binaries.
Technical Details
- Delivery mechanism: Excel attachments with VBA macros prompting users to enable macros, which then downloaded and executed malware payloads from the internet
- TVRAT/TeamSpy: Exploits TeamViewer via DLL search order hijacking — a malicious
msimg32.dllis bundled with a legitimate, digitally signed TeamViewer installer; the DLL hooks ~50 Windows APIs to suppress the TeamViewer UI while silently reporting the TeamViewer ID to a C2 server for remote access - DarkVNC: A hidden VNC (hVNC) tool that creates a concealed desktop session on the infected machine, first advertised on the Exploit forum in November 2016
- Scale and impact: ~80,000 users targeted across 255 fake freelance accounts; thousands of computers infected with TVRAT calling back to a U.S.-hosted C2 domain, with ~50% of victims in the United States
- Data theft: Stolen e-commerce login credentials and PII stored in a shared document within the attacker's email account, used for fraud and identity theft
- Legal charges: Conspiracy to commit wire fraud, transmission of malicious code to protected computers, conspiracy to commit computer fraud, unauthorized access for financial gain, and aggravated identity theft
Industry Insight
- Freelance and job-platform ecosystems remain high-value targets for both criminal and state-sponsored actors; organizations should implement enhanced monitoring and user awareness programs for job-seeking platforms
- The persistence of macro-based delivery in this 2016–2017 campaign validates Microsoft's 2022 decision to block VBA macros by default for internet-sourced Office files — organizations still allowing macros should treat this as a critical hardening gap
- DLL hijacking combined with signed legitimate binaries remains a potent evasion technique; endpoint detection should prioritize behavioral analysis of DLL load sequences and unexpected API hooking rather than relying solely on code-signing verification
Disclaimer: The above content is generated by AI and is for reference only.