Security NewsHighIncidentunauthorized access
Russian CTRL Toolkit Delivered via Malicious LNK Files Hijacks RDP via FRP Tunnels
UnknownMar 30, 2026(about 3 hours ago)
A Russian-origin CTRL toolkit distributed via malicious LNK files hijacks RDP via FRP tunnels, enabling credential phishing and keylogging.
Cybersecurity researchers have discovered a remote access toolkit of Russian-origin that's distributed via malicious Windows shortcut (LNK) files that are disguised as private key folders. The CTRL toolkit, according to Censys, is custom-built using .NET and includes various executables" to facilitate credential phishing, keylogging, Remote Desktop Protocol (RDP) hijacking, and reverse tunneling