Approximately half of the victims were in the United States
Assessment
The indictment gives the underlying figures: of "at least 2,169 computers infected with the TVRAT malware," "approximately 1,000 of those victim computers were in the United States, 46 of which were in the Northern District of California." One thousand of 2,169 is 46%, which "approximately half" describes fairly. The figure applies to the TVRAT campaign only; the indictment gives no country breakdown for the 1,584 DarkVNC infections beyond "at least one victim residing in the Northern District of California."
Where this claim appeared
US Department of Justice · 2026-09-01
https://www.justice.gov/usao-ndca/pr/russian-national-indicted-exploiting-online-platform-used-freelance-employment-andWhat “Verified” means
Established by primary sources — the original disclosure, a vendor incident report, a court filing, a government advisory, or the affected party itself. Where a claim is material, at least two independent sources agree.
5 of 5 · rating scale
Assessed in
The Freelance Platform That Delivered TeamSpy: 80,000 Job Invites, 2,169 Infections, One ExtraditionThink this assessment is wrong? Report an error.