Russian CTRL Toolkit Delivered via Malicious LNK Files Hijacks RDP via FRP Tunnels
Security analysts have identified a remote access toolkit attributed to Russian actors that is being spread using deceptive Windows shortcut (.LNK) files fashioned to look like folders containing private keys.
The toolkit, tracked as “CTRL” by researchers at Censys, is a purpose-built .NET suite composed of multiple executables. Its capabilities include credential phishing, system-wide keylogging, hijacking of Remote Desktop Protocol (RDP) sessions, and establishing reverse tunnels using Fast Reverse Proxy (FRP).
According to Censys security researcher Andrew Northern, the binaries are responsible for loading encrypted payloads, harvesting credentials through a convincing Windows Hello-style phishing interface, recording keystrokes, seizing RDP sessions, and tunneling traffic through FRP.
Censys says it recovered copies of the CTRL toolkit from an exposed directory hosted at 146.19.213[.]155 in February 2026. The attack begins with a weaponized LNK file named “Private Key #kfxm7p9q_yek.lnk” that uses a folder icon to entice users into double-clicking.
Clicking the shortcut kicks off a layered infection: each stage unpacks or decrypts the next payload until the full toolkit is deployed. The LNK acts as a dropper that runs a hidden PowerShell command which removes any existing persistence mechanisms from the target’s Windows Startup folder, decodes a Base64 blob and executes it in memory.
The initial stager probes TCP connectivity to hui228[.]ru:7000 and pulls down follow-up components from that server. It also alters firewall rules, creates scheduled tasks to survive reboots, provisions backdoor local accounts, and launches a cmd.exe shell listener on port 5267 that is reachable via the FRP tunnel.
One downloaded component, “ctrl.exe”, operates as a .NET loader that launches an embedded payload called the CTRL Management Platform. Depending on how it is invoked, this platform can function either as a server or a client, and it communicates internally over a Windows named pipe.
Censys explains that the dual-mode design lets an operator deploy ctrl.exe once on a compromised host (via the stager) and then manage it by running the ctrl.exe client through an RDP session routed over the FRP tunnel. By confining command-and-control traffic to a local named pipe, only the RDP session traverses the network, reducing external telemetry.
The toolkit’s command set enables system information collection, launching a credential-capture module, and starting a keylogger. When running as a server, the keylogger installs a keyboard hook and records every keystroke to C:\Temp\keylog.txt, which the operator can later retrieve.
The credential-capture piece is a Windows Presentation Foundation (WPF) application that impersonates the Windows PIN verification dialog to trick users into revealing their PIN. The fake prompt blocks common escape shortcuts like [Alt+Tab], [Alt+F4] and [F4], and it verifies entered PINs against the legitimate Windows authentication prompt using UI automation via SendKeys().
If the entered PIN is rejected, the victim sees an error and is prompted again. Even when the PIN passes validation against Windows, the phishing window can remain visible while the captured PIN is recorded with the prefix [STEALUSER PIN CAPTURED] in the same keylog file used by the background logger.
The toolkit can also push toast notifications impersonating popular browsers - including Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, Yandex, and Iron - to phish for additional credentials or to deliver follow-on payloads.
Two additional payloads are dropped by the campaign: FRPWrapper.exe, a Go-based DLL that is injected in memory to create reverse tunnels for RDP and a raw TCP shell to the operator’s FRP server; and RDPWrapper.exe, which allows unlimited concurrent RDP sessions.
The researchers conclude that CTRL exemplifies a shift toward compact, single-operator toolkits that emphasize stealth and OPSEC rather than a wide feature set. By funneling activity through FRP-based reverse tunnels into RDP sessions, operators can avoid the network-detectable beacon behaviors commonly seen in off-the-shelf remote access trojans.