Indicators of compromise · DarkVNC — 3 shown
165[.]245[.]160[.]178:5900165[.]245[.]171[.]220:590031[.]59[.]220[.]26:5900
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
US Charges Russian National for Malware Campaign That Infected 80,000 Freelancers
Summary
Searzhudin Tamirlanovich Aktulaev appeared in a San Francisco federal court after a May 2025 arrest in Cyprus and extradition to the US, facing conspiracy, aggravated identity theft and computer-damage charges carrying a maximum 20-year sentence. Prosecutors allege that between June 2016 and November 2017 he used 255 fake accounts on a freelance-employment platform's messaging system to distribute TVRAT (a.k.a. TVSpy/TeamSpy) via malicious Excel attachments, exploiting a TeamViewer flaw for remote takeover alongside a VNC-exploiting DarkVNC strain. About 80,000 users were infected — roughly half in the US, mostly in California — and the operator harvested e-commerce credentials and personal data for fraud.