[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJCHDvuxjm4ylUPL5Ye5Tpax4sQgbomtgFa7bPn1ezi4":3},{"article":4,"iocs":28,"watch_terms":49,"solutions":50,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":17,"category":18,"article_tags":22},"5bc8500e-0d71-4901-bec5-8c7916aa2d4a","Russian CTRL Toolkit Delivered via Malicious LNK Files Hijacks RDP via FRP Tunnels","russian-ctrl-toolkit-delivered-via-malicious-lnk-files-hijacks-rdp-via-frp-tunne","Cybersecurity researchers have discovered a remote access toolkit of Russian-origin that's distributed via malicious Windows shortcut (LNK) files that are disguised as private key folders. The CTRL toolkit, according to Censys, is custom-built using .NET and includes various executables\" to facilitate credential phishing, keylogging, Remote Desktop Protocol (RDP) hijacking, and reverse tunneling","Cybersecurity researchers discovered CTRL, a Russian-origin remote access toolkit delivered through weaponized Windows shortcut (LNK) files disguised as private key folders. The custom .NET malware facilitates credential phishing via Windows Hello spoofing, keylogging, RDP hijacking, and reverse tunneling through Fast Reverse Proxy (FRP), with all C2 traffic routed through RDP sessions to minimize network detection. The toolkit demonstrates advanced operational security by avoiding hard-coded C2 addresses and network beacons, making it difficult to detect via traditional forensic methods.","Russian CTRL toolkit distributed via malicious LNK files hijacks RDP sessions using FRP tunnels.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F03\u002Frussian-ctrl-toolkit-delivered-via.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEh05CEOtp0cIlsi1qDK4HRH2PPOFyvB5jca65pAQVsnCfBHZ-wRGt0s8VhvzO_l-4Q9H_xGKQsO_efVGzJ46ElLQNaq_FEp6wPUou4aqTvEKMPlEEGOTyEtISTj0VkC5QmO38HuxWehNDTUkdvCVCCp-GrIPWJyFt4dTLp1TIbqW8hAiVEJ-vxnoKUexR6-\u002Fs1600\u002Fctrl-ctrl.jpg","2026-03-30T09:58:00+00:00","2026-03-30T12:00:09.804097+00:00",9,[],"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":17,"icon":19,"name":20,"slug":21},null,"Malware","malware",[23],{"category":24},{"id":25,"icon":19,"name":26,"slug":27},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[29,33,37,40,43,46],{"type":30,"value":31,"context":32},"ip","146.19.213.155","Open directory hosting CTRL toolkit discovered in February 2026",{"type":34,"value":35,"context":36},"domain","hui228.ru","C2 server on port 7000 for downloading next-stage payloads",{"type":21,"value":38,"context":39},"CTRL","Russian-origin .NET remote access toolkit with RDP hijacking, credential phishing, and keylogging capabilities",{"type":21,"value":41,"context":42},"FRPWrapper.exe","Go DLL payload for establishing reverse tunnels via FRP",{"type":21,"value":44,"context":45},"RDPWrapper.exe","Payload enabling unlimited concurrent RDP sessions",{"type":21,"value":47,"context":48},"ctrl.exe",".NET loader functioning as CTRL Management Platform server\u002Fclient",[],{"controls":51,"vendors":136},[52,81,110],{"slug":53,"name":54,"problem":55,"products":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":82,"name":83,"problem":84,"products":85},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"slug":111,"name":112,"problem":113,"products":114},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":132,"product_name":133,"url":134,"description":135},"darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",[137],{"slug":138,"name":139,"logo_path":140,"roles":141},"censys","Censys","\u002Fvendor-logos\u002Fcensys.png",[142],"reported_by",{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":153},"russian-ctrl-toolkit-exploits-user-trust-and-network-architecture","Russian CTRL Toolkit Exploits User Trust and Network Architecture","The CTRL toolkit demonstrates how attackers exploit user trust through social engineering, using disguised LNK files that appear as legitimate private key folders to gain initial access. Once deployed, the malware leverages advanced evasion techniques including RDP hijacking and reverse tunneling through Fast Reverse Proxy (FRP) to maintain persistence while avoiding detection. The attack's success relies on both human vulnerability to deceptive file presentations and inadequate network monitoring that fails to detect abnormal RDP traffic patterns. This highlights the critical need for comprehensive user education and robust network segmentation to limit lateral movement.",[148,149,150,151,152],"CIS Control 7 (Email and Web Browser Protections)","CIS Control 12 (Network Infrastructure Management)","NIST AC-3 (Access Enforcement)","NIST SI-4 (Information System Monitoring)","MITRE ATT&CK T1547 (Boot or Logon Autostart Execution)",{}]