Russian CTRL Toolkit Delivered via Malicious LNK Files Hijacks RDP via FRP Tunnels

Researchers uncovered a Russian-origin remote access toolkit called CTRL distributed via malicious Windows LNK files that impersonate private key folders; the toolkit is a .NET-based RAT providing credential harvesting (a Windows Hello PIN phishing UI), keylogging, RDP session hijacking, and reverse tunneling via FRP. The attack chain uses a hidden PowerShell stager that tests connectivity to hui228.ru:7000, downloads and launches ctrl.exe (a dual-mode management platform communicating over a named pipe), and drops FRPWrapper.exe and RDPWrapper.exe to establish FRP tunnels and enable concurrent RDP sessions — an architecture designed to minimize traditional network C2 artifacts.