US charges Russian for infecting 80,000 freelancers with malware

Between June 2016 and November 2017, the defendant exploited an online messaging platform of a freelance employment technology company to send phishing emails with malicious Excel attachments containing macros. These attachments downloaded TVRAT (also known as TeamSPy or TVSPY) and DarkVNC malware onto victims' computers. Both malware variants allowed remote access via TeamViewer and VNC Viewer tools and sent stolen data to command-and-control servers. The stolen data was used for fraud and other criminal activities. The campaign infected around 80,000 freelancers, with half of the victims in the United States. The attacker was arrested in Cyprus in 2025 and extradited to the US.

The malware infections allowed attackers to gain remote control over victims' systems and steal sensitive information such as e-commerce login credentials and personally identifiable information. This facilitated fraud and other criminal activities. The scale of the campaign affected approximately 80,000 freelancers, impacting their privacy and security. The attack also compromised a significant number of users in the United States, particularly in Northern California.

This is a law enforcement case involving a past phishing and malware campaign. There is no direct patch or remediation applicable to software products. Organizations should ensure they educate users about phishing risks, disable macros in Office documents by default, and use endpoint protection solutions to detect and block malware like TVRAT and DarkVNC. Since the attacker is in custody and the campaign is historical, no urgent remediation is required for this specific threat.