Full Report
Cybersecurity researchers have discovered a remote access toolkit of Russian-origin that's distributed via malicious Windows shortcut (LNK) files that are disguised as private key folders. The CTRL toolkit, according to Censys, is custom-built using .NET and includes various executables" to facilitate credential phishing, keylogging, Remote Desktop Protocol (RDP) hijacking, and reverse tunneling
Analysis Summary
# Tool/Technique: CTRL Toolkit
## Overview
The **CTRL Toolkit** is a custom-built Russian-origin remote access framework developed in .NET. It is designed for stealthy post-exploitation activities, including credential harvesting, RDP session hijacking, and keylogging. Its primary innovation is its "named pipe" architecture, which keeps command-and-control (C2) traffic local to the victim machine, tunneling data through an encrypted Fast Reverse Proxy (FRP) to evade traditional network-based detection.
## Technical Details
- **Type:** Malware Framework / Remote Access Toolkit
- **Platform:** Windows
- **Capabilities:** Credential phishing (Windows Hello), Keylogging, RDP Hijacking, Reverse Shell, Persistence, Browser Spoofing.
- **First Seen:** February 2026 (Reported by Censys)
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.001 - Phishing: Spearphishing Attachment (LNK Files)
- **TA0003 - Persistence**
- T1053.005 - Scheduled Task/Job: Scheduled Task
- T1136.001 - Create Account: Local Account
- **TA0004 - Privilege Escalation**
- T1548 - Abuse Elevation Control Mechanism
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information (Base64/Encrypted payloads)
- T1562.004 - Impair Defenses: Disable or Modify System Firewall
- T1070 - Indicator Removal on Host (Clearing Startup folder)
- **TA0006 - Credential Access**
- T1056.001 - Input Capture: Keylogging
- T1556.002 - Modify Authentication Process: Password Filter (LNK/UI Phishing)
- **TA0011 - Command and Control**
- T1572 - Protocol Tunneling (FRP)
- T1071.001 - Application Layer Protocol: Web Protocols
- T1559.001 - Inter-Process Communication: Simple Named Pipes
## Functionality
### Core Capabilities
- **Multi-Stage Loading:** Uses weaponized LNK files disguised as private keys to execute PowerShell commands that decode and launch a stager in memory.
- **Dual-Mode Loader (ctrl.exe):** A .NET loader that acts as either a server or a client. It uses Windows named pipes for local communication, ensuring C2 traffic does not trigger network alerts.
- **Reverse Tunneling:** Integrates **FRP (Fast Reverse Proxy)** to create tunnels for RDP and raw TCP shells.
- **RDP Hijacking:** Includes a component to enable unlimited concurrent RDP sessions on the victim host.
### Advanced Features
- **Windows Hello Phishing:** A WPF-based application creates a pixel-perfect imitation of the Windows PIN prompt. It utilizes UI automation (`SendKeys()`) to validate the real PIN while simultaneously stealing it.
- **Browser Impersonation:** Can trigger "Toast" notifications that mimic browsers (Chrome, Edge, etc.) to lure users into entering credentials.
- **OPSEC Design:** The binaries do not contain hardcoded C2 addresses; instead, they rely on the operator connecting manually via the established FRP tunnel to read local log files.
## Indicators of Compromise
- **File Names:**
- `Private Key #kfxm7p9q_yek.lnk`
- `ctrl.exe`
- `FRPWrapper.exe`
- `RDPWrapper.exe`
- **Network Indicators:**
- `146.19.213[.]155` (Open Directory)
- `hui228[.]ru` (Payload delivery/Stager)
- Port `7000` (FRP)
- Port `5267` (CMD Shell)
- **Behavioral Indicators:**
- Creation of a local file at `C:\Temp\keylog.txt`.
- Modification of Windows Firewall rules to allow localized tunneling.
- Unexpected PowerShell execution originating from `.lnk` files in the Startup or Downloads folders.
## Associated Threat Actors
- **Origin:** Russian (Specific group attribution pending/Unspecified).
## Detection Methods
- **Behavioral Detection:** Monitor for processes utilizing `SendKeys()` or UI Automation libraries outside of known administrative tools.
- **Network Monitoring:** Look for outbound connections on non-standard ports associated with Fast Reverse Proxy (FRP) or unauthorized RDP traffic exiting the network.
- **Process Auditing:** Monitor for `cmd.exe` or `powershell.exe` being spawned directly by `Explorer.exe` via an `.lnk` file.
## Mitigation Strategies
- **User Education:** Train staff to recognize that private keys are not typically distributed as `.lnk` (shortcut) files.
- **Host Hardening:** Disable or restrict the execution of PowerShell and CMD for standard users. Use AppLocker or Windows Defender Application Control (WDAC) to block unsigned executables like `FRPWrapper.exe`.
- **RDP Security:** Implement Multi-Factor Authentication (MFA) for all RDP sessions and restrict RDP access via the firewall to specific authorized internal IPs only.
## Related Tools/Techniques
- **FRP (Fast Reverse Proxy):** Common legitimate utility abused for tunneling.
- **RDP Wrapper:** Open-source tool often used to enable multiple RDP sessions on non-server Windows versions.
- **LNK Droppers:** Techniques similar to those seen in Emotet or QakBot delivery chains.