:

US CHARGES RUSSIAN IN 80,000-FREELANCER MALWARE PLOT

SECURITY DESK1 MIN READ
WED, SEP 2, 2026

■ AI-SUMMARIZED FROM 1 SOURCE ▸ TIMELINE

A California federal grand jury has indicted a Russian national for orchestrating a phishing campaign that infected thousands of freelancers with TVRAT and DarkVNC malware.

The indictment alleges the suspect targeted independent contractors through fraudulent emails designed to distribute remote access trojans. Once installed, the malware gave attackers control over victims' systems, potentially exposing sensitive data and enabling further cyberattacks. TVRAT and DarkVNC are commodity malware commonly used for system reconnaissance, credential theft, and lateral movement within networks. Freelancers represent a particularly vulnerable population due to their typically lower security defenses compared to enterprise environments. The case underscores ongoing threats from state-sponsored and independent Russian cybercriminals targeting US-based workers. Authorities did not disclose whether the defendant remains in custody or the specific timeline of the alleged campaign. The charge represents the Justice Department's continued effort to hold foreign nationals accountable for cybercrimes affecting Americans.

■ SOURCES

Bleeping Computer

■ SUMMARY WRITTEN BY AI FROM THE LINKS ABOVE

■ MORE FROM THE SECURITY DESK

The FBI is investigating a newly launched dark web service called Nexus that claims to possess digital scans of over 153 million driver's licenses from US and Canadian residents. The service is actively selling the stolen identification data.

1H AGOAI Desk

International law enforcement agencies and private sector partners have seized infrastructure belonging to the Sality malware botnet, a peer-to-peer network used for unauthorized computer access and data theft.

2H AGOIndustry Desk

SonicWall has warned customers of two new zero-day vulnerabilities in its SMA1000 appliances being chained together in active remote code execution attacks.

3H AGOSecurity Desk

A newly launched dark web marketplace is selling digital scans of over 153 million driver's licenses from U.S. and Canadian residents. The FBI's New Orleans field office has opened an investigation into the breach, which appears to originate from a Louisiana-based identity verification company.

11H AGOSecurity Desk

■ SUBSCRIBE TO THE DAILY BRIEF

ONE EMAIL, 5 STORIES, 06:00 UTC. UNSUBSCRIBE ANYTIME.