Russian CTRL Toolkit Delivered via Malicious LNK Files Hijacks RDP via FRP Tunnels
Russian CTRL toolkit distributed via malicious LNK files hijacks RDP sessions using FRP tunnels.
Cybersecurity researchers discovered CTRL, a Russian-origin remote access toolkit delivered through weaponized Windows shortcut (LNK) files disguised as private key folders. The custom .NET malware facilitates credential phishing via Windows Hello spoofing, keylogging, RDP hijacking, and reverse tunneling through Fast Reverse Proxy (FRP), with all C2 traffic routed through RDP sessions to minimize network detection. The toolkit demonstrates advanced operational security by avoiding hard-coded C2 addresses and network beacons, making it difficult to detect via traditional forensic methods.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonThe CTRL toolkit demonstrates how attackers exploit user trust through social engineering, using disguised LNK files that appear as legitimate private key folders to gain initial access. Once deployed, the malware leverages advanced evasion techniques including RDP hijacking and reverse tunneling through Fast Reverse Proxy (FRP) to maintain persistence while avoiding detection. The attack's success relies on both human vulnerability to deceptive file presentations and inadequate network monitoring that fails to detect abnormal RDP traffic patterns. This highlights the critical need for comprehensive user education and robust network segmentation to limit lateral movement.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- ip — 146.19.213.155
- domain — hui228.ru
- malware — CTRL
- malware — FRPWrapper.exe
- malware — RDPWrapper.exe
- malware — ctrl.exe