Russian CTRL Toolkit Uses Fake Private Key Files to Hijack RDP Sessions and Harvest Credentials

Cybersecurity researchers at attack surface management platform Censys have uncovered a previously undocumented Russian-origin remote access toolkit — dubbed CTRL — that is being distributed through weaponised Windows LNK shortcut files disguised as private key folders. The toolkit is custom-built in .NET and designed for a single, disciplined operator to achieve deep, persistent access to victim machines with minimal network-detectable activity.

CTRL was recovered from an open directory at 146.19.213[.]155 in February 2026, discovered through Censys open directory scanning for LNK files. None of the binaries or infrastructure had appeared in any public threat intelligence feeds at the time of discovery, making this a previously undocumented toolkit purpose-built for persistent remote access and credential theft.

How the Attack Unfolds

The infection chain begins with a deceptively simple lure: a weaponised LNK file named "Private Key #kfxm7p9q_yek.lnk" styled with a folder icon to trick the target into double-clicking it. From there, a multi-stage process unfolds — each stage decrypting or decompressing the next — until the full toolkit is deployed on the victim's machine.

The LNK dropper launches a hidden PowerShell command that first wipes existing persistence mechanisms from the Windows Startup folder, then decodes a Base64-encoded payload and runs it entirely in memory. A stager component then tests TCP connectivity to the operator's command infrastructure and downloads subsequent payloads. It also modifies firewall rules, establishes persistence via scheduled tasks, creates backdoor local user accounts, and opens a cmd.exe shell server accessible through a Fast Reverse Proxy (FRP) tunnel.

Credential Harvesting via a Fake Windows Hello Prompt

One of CTRL's most technically sophisticated components is its credential harvesting module — a fully polished Windows Presentation Foundation (WPF) application that impersonates a genuine Windows Hello PIN verification prompt, complete with the victim's real display name, account photo and system theme. A low-level keyboard hook blocks Alt+Tab, Alt+F4 and the Win key to prevent escape, while captured PINs are validated against the real Windows credential prompt via UI automation before acceptance. All captured credentials are logged to a file on the victim's machine alongside keystrokes captured by a background keylogger.

The toolkit also sends toast notifications impersonating major web browsers — including Google Chrome, Microsoft Edge, Brave, Opera, Vivaldi and Yandex — to conduct further credential theft or deliver additional payloads.

Architecture Built for Stealth

CTRL's operational architecture is what sets it apart from commodity remote access trojans (RATs). The toolkit consists of three core components: the main ctrl.exe loader, FRPWrapper.exe — a Go DLL loaded in memory to establish reverse tunnels for RDP and raw TCP shells — and RDPWrapper.exe, which enables unlimited concurrent RDP sessions by automatically patching termsrv.dll.

The named pipe architecture keeps all command-and-control traffic local to the victim machine — nothing traverses the network except the RDP session itself. All data exfiltration occurs through the FRP tunnel via RDP, with the operator connecting to the victim's desktop and reading keylog data through the ctrl named pipe. This architecture leaves minimal network forensic artefacts compared to traditional C2 beacon patterns.

Censys researcher Andrew Northern summarised the tactical significance: "The CTRL toolkit demonstrates a trend toward purpose-built, single-operator toolkits that prioritise operational security over feature breadth. By routing all interaction through FRP reverse tunnels to RDP sessions, the operator avoids the network-detectable beacon patterns that characterise commodity RATs."

Attribution and Infrastructure

PDB paths, Russian-language error strings in the FRP wrapper and the use of a .ru domain collectively point to a Russian-speaking developer. The toolkit's FRP relay infrastructure was observed on two IP addresses within Partner Hosting LTD's Frankfurt infrastructure, active between January and February 2026.
Attribution to a specific threat actor or group remains under investigation, with no definitive link to a named state-sponsored entity at this time.

Security teams are advised to monitor for binary data written to Explorer registry keys, alert on scheduled task creation using specific names associated with CTRL, and watch for termsrv.dll modifications, RDP Wrapper installation and Defender exclusion additions — all indicators of a potential CTRL compromise.