Extradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands

The U.S. Department of Justice (DoJ) has charged a Russian national, extradited from Cyprus on August 28, with using roughly 255 fake accounts on a freelance platform to send malware-laced Excel attachments to about 80,000 of its users in 2016 and 2017. Searzhudin Tamirlanovich Aktulaev, 40, was arrested in Cyprus in May 2025, the U.S. Attorney's Office for the Northern District of California

Reported facts: U.S. authorities charged a Russian national, extradited from Cyprus, with using around 255 fake freelance-platform accounts to distribute malware-laced Excel files to roughly 80,000 users in 2016–2017. The campaign involved large-scale social engineering and exploitation of trust in a digital marketplace to deliver malicious payloads. RealGround analysis: While the case centers on traditional malware and not AI, it highlights how large user platforms can be abused as distribution channels for future AI-powered attacks (e.g., AI-generated lures or malicious AI tools embedded in documents). Organizations using AI agents on email, documents, or marketplaces should adopt continuous red teaming and CISO-led governance to test for and mitigate risks where AI systems might automatically process, open, or act on untrusted content at scale.