Russian CTRL Toolkit Delivered via Malicious LNK Files Hijacks RDP via FRP Tunnels

Monday, March 30, 2026 at 12:18 PM UTC·Source: The Hacker News

Updated: Thursday, April 2, 2026 at 05:46 PM UTC

Executive Summary

Cybersecurity researchers have discovered a remote access toolkit of Russian-origin that's distributed via malicious Windows shortcut (LNK) files that are disguised as private key folders. The CTRL toolkit, according to Censys, is custom-built using .NET and includes various executables" to facilitate credential phishing, keylogging, Remote Desktop Protocol (RDP) hijacking, and reverse tunneling

Analysis

Source Attribution

Originally published by The Hacker News on Mar 30, 2026.

Related Threats

CRITICALPhishing

Yokogawa CENTUM VP

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-092-02.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could allow an attacker to login as the PROG user and modify permissions.</strong></p> <p>The following versions of Yokogawa CENTUM VP are affected:</p> <ul> <li>CENTUM VP >=R5.01.00|</li>

CVE-2025-7741

17h agoCISA Advisories

LOWPhishing

New EvilTokens service fuels Microsoft device code phishing attacks

A new malicious kit called EvilTokens integrates device code phishing capabilities, allowing attackers to hijack Microsoft accounts and provide advanced features for business email compromise attacks. [...]

1d agoBleepingComputer

CRITICALPhishing

PX4 Autopilot

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-090-02.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could allow an attacker with access to the MAVLink interface to execute arbitrary shell commands without cryptographic authentication.</strong></p> <p>The following versions of PX4 Autopil

CVE-2026-1579

2d agoCISA Advisories