U.S. authorities have extradited three Russian nationals since June to face charges in separate cybercrime cases involving malware attacks, bank fraud and the hacking of government and private-sector organizations.
The extraditions from Cyprus, Georgia and Thailand come as Washington steps up efforts to prosecute suspected cybercriminals operating outside the United States. The three men are accused of schemes that collectively affected tens of thousands of people and caused millions of dollars in losses.
The most recent case involves Searzhudin Aktulayev, 40, who was arrested in Cyprus in May 2025 and extradited to the United States on Aug. 28. He made his first appearance in federal court in San Francisco on Aug. 31.
The U.S. Embassy in Cyprus on Thursday congratulated Cypriot police on the extradition.
Prosecutors allege that Aktulayev and his co-conspirators used about 255 fake accounts on an online platform for freelance workers to send malicious files to approximately 80,000 users between 2016 and 2017.
Once opened, the files installed malware that gave the group remote access to infected computers and allowed it to steal data, according to the indictment. About half of the potential victims were in the U.S.
Investigators said they uncovered data belonging to thousands of victims, including e-commerce login credentials and personal information for hundreds of people.
Aktulayev has been charged with conspiracy to commit wire fraud, distributing malicious code, unauthorized computer access and aggravated identity theft, among other offenses. The most serious charge carries a maximum prison sentence of 20 years.
His extradition came weeks after Georgia handed over Russian web developer Sergei Filimonov, who appeared in federal court in Atlanta on Sept. 4.
Prosecutors accuse Filimonov and his co-conspirators of creating fake websites for U.S. banks between November 2023 and October 2025. The group allegedly purchased sponsored Google links that directed bank customers to fraudulent login pages designed to steal their credentials.
The scheme led to $28 million in unauthorized transfers from U.S. bank accounts, the Justice Department said.
Filimonov allegedly maintained the operation’s technical infrastructure, including a database containing more than 5,000 stolen login credentials. He has been charged with conspiracy to commit bank and wire fraud and aggravated identity theft.
The charges carry a combined statutory maximum of 175 years in prison, though defendants convicted in U.S. federal courts typically receive sentences well below the total maximum available under each count.
In June, Thailand extradited a third Russian national, 36-year-old Denis Obrezko, to face charges in Boston.
U.S. authorities accuse Obrezko of supporting Void Blizzard, a hacking group that Microsoft has linked to Russian interests. The group has operated since at least April 2024 and has targeted government agencies, defense and transportation companies, media outlets, healthcare providers and nongovernmental organizations in NATO countries and Ukraine, according to Microsoft.
The FBI identified 11 U.S. companies that had been compromised.
Investigators said they found summaries of more than 13,000 stolen emails belonging to lawmakers in an eastern European country on Obrezko’s phone. They also linked him to payments for a virtual server and a domain used in attacks against U.S. companies.
Obrezko has been charged with conspiracy to commit computer fraud and unauthorized access to protected computer systems. He faces up to 10 years in prison if convicted.
This article was translated with the help of artificial intelligence and was reviewed by a Moscow Times editor before publication. Learn more about our newsroom's AI policy here.
Read this article in Russian at The Moscow Times' Russian service.
A Message from The Moscow Times:
Dear readers,
We are facing unprecedented challenges. Russia's Prosecutor General's Office has designated The Moscow Times as an "undesirable" organization, criminalizing our work and putting our staff at risk of prosecution. This follows our earlier unjust labeling as a "foreign agent."
These actions are direct attempts to silence independent journalism in Russia. The authorities claim our work "discredits the decisions of the Russian leadership." We see things differently: we strive to provide accurate, unbiased reporting on Russia.
We, the journalists of The Moscow Times, refuse to be silenced. But to continue our work, we need your help.
Your support, no matter how small, makes a world of difference. If you can, please support us monthly starting from just $2. It's quick to set up, and every contribution makes a significant impact.
By supporting The Moscow Times, you're defending open, independent journalism in the face of repression. Thank you for standing with us.
Remind me later.
