CTRL Toolkit: How Russian LNK Malware Hijacks RDP Sessions

What Is the CTRL Toolkit and Why Does It Matter?

Censys researchers have identified a custom-built remote access toolkit of Russian origin, tracked as CTRL, that is actively targeting Windows systems. The toolkit is written in .NET and distributed through malicious Windows shortcut files — LNK files — disguised as folders containing private cryptographic keys. The disguise is deliberate: it targets the kind of files that system administrators and developers routinely handle, increasing the likelihood of execution. What makes CTRL notable is not just its delivery method but its capability set. Once deployed, it combines credential phishing, keylogging, RDP session hijacking, and reverse tunnelling through Fast Reverse Proxy (FRP) into a single, modular package. Each component is a separate executable, suggesting the toolkit is designed to be deployed selectively depending on the target environment. For UK and New Zealand businesses, this is not an abstract threat. RDP remains one of the most widely exposed services on corporate networks, and LNK-based delivery continues to bypass traditional perimeter defences because it exploits trusted Windows functionality rather than software vulnerabilities.

How Does the CTRL Toolkit Actually Work?

The attack chain begins with a malicious LNK file. Windows shortcut files are a persistent favourite among threat actors because they can execute arbitrary commands while appearing to open a legitimate folder or document. In this case, the LNK files are dressed up as private key directories — the kind a developer or sysadmin might receive via email, a shared drive, or a messaging platform without immediate suspicion. Once the LNK file executes, CTRL's modular components are staged on the target system. The credential phishing module captures authentication data, while the keylogger records subsequent input. The most consequential component, however, is the RDP hijacking module, which takes over existing Remote Desktop sessions. This is significant: rather than creating a new connection that might appear in logs or trigger alerts, the attacker rides an already-authenticated session, inheriting its permissions without needing to authenticate again. The reverse tunnelling component uses FRP — a legitimate, open-source tool widely used for exposing internal services through firewalls — to route traffic back to attacker-controlled infrastructure. Because FRP is a known and commonly used utility, its network traffic can blend in with legitimate activity. The result is a persistent, low-visibility foothold that standard signature-based detection can easily miss. Put simply: the attacker gets in through a convincing file, steals credentials, takes over an active session, and then routes all their activity through an encrypted tunnel that looks like normal network traffic.

Why RDP Hijacking Is More Dangerous Than a Standard Breach

RDP hijacking deserves specific attention because it bypasses several controls that organisations typically rely on. When an attacker creates a new RDP connection, they need valid credentials, and that connection generates a login event. Security teams monitoring authentication logs have a chance to spot anomalous access. Session hijacking removes that step entirely. The attacker inherits an existing authenticated session, meaning no new login occurs and no additional credential verification is triggered. In environments where RDP is used for legitimate remote administration — which describes the majority of enterprise Windows environments — the traffic generated by a hijacked session is indistinguishable from normal administrator activity at the network level. Without endpoint-level behavioural monitoring, the attack is effectively invisible until the damage is done. Combine this with FRP tunnelling, and you have an attacker who can maintain persistent access, move laterally, exfiltrate data, and deploy secondary payloads while generating minimal forensic evidence. Microsoft's own security guidance consistently identifies RDP exposure as one of the highest-risk attack surfaces for enterprise environments, and this toolkit demonstrates why that assessment stands.

What Security Controls Would Have Stopped This Attack?

This is the more actionable question. The CTRL toolkit's attack chain has several points at which it can be intercepted, and understanding those points tells you where your defences need to be strongest. The LNK delivery stage is the first opportunity. Email and endpoint controls that inspect shortcut files for embedded command execution — rather than simply checking file extensions — would flag this before the payload stages. Solutions like Coro, which unifies email and endpoint protection, are built to catch exactly this kind of delivery mechanism across the Microsoft 365 environments where these files most commonly arrive. For organisations in New Zealand and Australia, ESET's enterprise endpoint protection provides deep inspection of file behaviour at execution time, which catches LNK-based attacks that perimeter filtering misses. The reverse tunnelling stage is the second critical intercept point. FRP traffic, while legitimate in isolation, produces specific network patterns — particularly outbound connections to unusual infrastructure. Sophos XDR correlates endpoint and network telemetry to surface this kind of anomaly, and Sophos MDR's 24/7 analyst team can act on it before the attacker establishes a persistent foothold. Hadrian's continuous attack surface monitoring would also identify externally exposed RDP services before attackers do, giving security teams the opportunity to reduce exposure proactively. Finally, if the attacker does reach the data exfiltration stage, BlackFog's anti data exfiltration technology provides a last line of defence by blocking unauthorised data transfers at the device level — even when the transfer attempts to route through encrypted tunnels.

• Inspect LNK files for embedded command execution, not just file type
• Monitor outbound FRP and reverse tunnel traffic patterns
• Restrict and audit RDP exposure using attack surface management tools
• Deploy endpoint behavioural detection that catches post-execution staging
• Implement data exfiltration controls that operate independently of network visibility

The Bigger Pattern: Dual-Use Tools and Living-Off-the-Land Tactics

CTRL is one example of a broader shift in how sophisticated threat actors operate. Rather than relying entirely on custom malware that security vendors can fingerprint and block, they increasingly combine custom components with legitimate, widely available tools. FRP is free, open-source, and used by developers worldwide. LNK files are a standard part of Windows. .NET is Microsoft's own development framework. This approach — often described as living-off-the-land — makes detection harder because there is no single malicious binary to identify. The attack looks like normal activity right up until the point it causes damage. This has a direct implication for how organisations should evaluate their defences. Signature-based detection, which identifies known malicious files, is not sufficient against toolkits like CTRL. What is required is behavioural detection: monitoring what processes do, what connections they make, and what data they access — and comparing that against a baseline of normal activity. The organisations most exposed to this class of attack are those still relying on traditional antivirus as their primary endpoint control, those with RDP services exposed directly to the internet, and those without visibility into encrypted outbound traffic. These are common configurations, particularly in small and mid-sized businesses that have not yet moved to a unified security platform.

Recommendations for UK and New Zealand Organisations

Based on the CTRL toolkit's documented capabilities, here are the specific steps organisations should take to reduce their exposure. First, audit your RDP exposure immediately. Any RDP service accessible directly from the internet is a high-priority risk. If RDP is required for remote administration, it should sit behind a VPN with multi-factor authentication enforced. Hadrian's attack surface management platform continuously maps your external-facing infrastructure and flags exposed services — including RDP — before attackers find them. You can learn more about what Hadrian covers at /products/hadrian. Second, review how your endpoint security handles shortcut file execution. If your current solution only scans files rather than monitoring their runtime behaviour, you have a gap that LNK-based attacks will exploit. This applies equally to UK organisations evaluating Coro and to New Zealand businesses running ESET enterprise deployments. Third, assess your third-party and supply chain risk. Toolkits distributed through convincing file disguises often reach targets via compromised suppliers, shared collaboration platforms, or contractor workstations. Panorays provides continuous visibility into your supply chain's security posture, which is increasingly where the first compromise occurs. Fourth, if you do not have 24/7 monitoring in place, consider whether your internal team has the capacity to detect and respond to a session hijacking attack that generates no new authentication events. Sophos MDR provides that coverage, with analysts who understand the specific behavioural signatures associated with FRP tunnelling and RDP abuse.

The Takeaway

The CTRL toolkit is a well-constructed, modular attack framework that exploits trusted Windows functionality, legitimate open-source tooling, and common enterprise configurations. It does not rely on zero-day vulnerabilities or nation-state-level infrastructure — it works because most organisations have not fully addressed their RDP exposure, do not inspect shortcut file behaviour at runtime, and lack visibility into encrypted outbound tunnelling activity. That is not a verdict on any particular organisation's competence. It reflects the reality that security tooling has not kept pace with how attacks are actually constructed in 2025. The gap between what organisations believe their controls cover and what those controls actually detect is where toolkits like CTRL operate. If you want a clear assessment of where that gap exists in your environment, Kyanite Blue Labs can help. Our team works with the full product stack across UK and New Zealand markets to identify exactly these kinds of exposures before they become incidents.

Frequently Asked Questions