Russian Cybercriminal Extradited from Cyprus Charged in Massive Excel Malware Scheme

The U.S. Department of Justice announced Tuesday that a Russian national, Searzhudin Tamirlanovich, has been formally charged with orchestrating a large‑scale malware distribution campaign that targeted tens of thousands of users of a popular freelance marketplace in 2016 and 2017. The indictment follows his extradition from Cyprus on August 28, after Cypriot authorities detained him at the request of American law‑enforcement officials.

According to the filing, Tamirlanovich created roughly 255 counterfeit accounts on the freelance platform, posing as service providers and freelancers. Through these personas he dispatched Excel files embedded with malicious macros to an estimated 80,000 distinct recipients. The files were marketed as legitimate work‑related documents, exploiting the trust users place in platform communications.

Once opened, the macro‑enabled spreadsheets triggered the download and execution of a malicious payload that granted the attacker remote access to the victim’s computer. Security researchers have linked the code to a broader family of “Excel‑based” malware that has been used in espionage and financial theft operations since the mid‑2010s. The campaign’s scale places it among the most extensive misuse of a freelance marketplace for cyber‑crime to date.

U.S. officials highlighted the case as part of a growing focus on transnational cyber‑crime networks that leverage legitimate online services to reach a broad audience. While the indictment does not disclose the ultimate objectives of the operation, investigators suggest that the compromised systems may have been used for credential harvesting, data exfiltration, or as footholds for further intrusion. The Department of Justice has indicated that additional charges could be considered if further evidence emerges.

Tamirlanovich’s extradition underscores the increasing cooperation between European and American law‑enforcement agencies in tackling cross‑border cyber threats. Cyprus, a member of the European Union, has been pressured to align its legal framework with international standards for cyber‑crime prosecution. The case is expected to proceed through the U.S. federal court system, where prosecutors will seek a conviction that could carry a substantial prison term and financial penalties. The outcome may also prompt freelance platforms to tighten verification processes and enhance user‑level security warnings for macro‑enabled attachments.