Loading story…
Censys researchers disclosed a previously undocumented Russian-origin remote access toolkit dubbed CTRL that is delivered through malicious Windows .lnk files disguised as private key folders. The shortcut launches hidden PowerShell, loads a .NET stager from the registry, retrieves additional payloads from hui228[.]ru:7000, and installs components that provide persistence, firewall modifications, local backdoor accounts, and a shell server. Researchers said the framework supports credential phishing, keylogging, and remote access while keeping much of its command activity local through named pipes, with ctrl.exe acting as the command platform.
CTRL also includes a Windows Hello-style phishing module that mimics the legitimate PIN prompt and validates stolen PINs against the real credential dialog, alongside a keylogger that writes to C:\Temp\keylog.txt. To give operators stealthy hands-on-keyboard access, the toolkit deploys components such as FRPWrapper.exe and RDPWrapper.exe to create Fast Reverse Proxy tunnels and enable concurrent RDP sessions instead of relying on traditional network-visible C2 beaconing. Censys linked the infrastructure to hui228[.]ru and FRP relay activity on 194.33.61.36 and later 109.107.168.18, and said the toolkit and related binaries were not present in major public malware repositories at the time of analysis, indicating a privately developed framework with limited public exposure.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
The Hacker News summarized Censys' findings on CTRL, highlighting its malicious shortcut delivery, in-memory PowerShell execution, contact with hui228[.]ru:7000, firewall changes, local backdoor users, and tunneled RDP access. The report did not introduce a separate new incident but amplified the public disclosure of the toolkit's capabilities and infrastructure.
Censys ARC published research detailing the Russian-origin CTRL remote access toolkit, including its LNK-based infection chain, Windows Hello PIN phishing, keylogging, persistence, and RDP hijacking via FRP tunnels. The researchers noted the binaries and infrastructure were not present in major public malware repositories or threat intelligence sources at the time of publication.
Censys identified operator infrastructure for the Russian-origin CTRL framework using hui228[.]ru and FRP relay activity on 194.33.61.36, later shifting to 109.107.168.18, both hosted by Partner Hosting LTD in Frankfurt. The servers exposed FRP, HTTP, and vulnerable OpenSSH services supporting the toolkit's reverse-tunneled remote access model.
In February 2026, Censys recovered the previously undocumented CTRL toolkit from an open directory at 146.19.213[.]155. Analysis showed the .NET-based framework was delivered via malicious Windows LNK files and designed for stealthy hands-on-keyboard access using local named pipes and FRP-tunneled RDP.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple incident reports show attackers repeatedly using exposed or weakly protected **Remote Desktop Protocol (RDP)** as both an entry point and an internal movement channel. In one intrusion, an actor brute-forced a local administrator account over RDP, created additional access, used **Mimikatz** to dump credentials and Kerberos tickets, and moved across systems before deploying an **XMRig**-based Monero miner. Separate reporting on **Conti** and other hands-on-keyboard operations shows similar post-compromise tradecraft, including credential theft, reconnaissance, use of remote management utilities, and abuse of legitimate Windows administration features to avoid dropping obvious backdoors. Ransomware and espionage cases show the same pattern extending to interactive remote-control tooling beyond standard RDP. ASEC reported **Crysis/Dharma** and **Venus** ransomware actors brute-forcing RDP, stealing credentials, terminating processes, deleting shadow copies, and encrypting systems, sometimes retrying with a second ransomware family after a failed first attempt. North Korea-linked **Kimsuky** has also used **RDP Wrapper**, patched Terminal Services, **VNC**, **Chrome Remote Desktop**, **Ngrok**, and malware such as **AppleSeed**, **Amadey**, and **RftRAT** to maintain GUI-based access, evade user awareness, and support keylogging, file theft, and persistent control of compromised hosts.
Aug 14, 2026
Threat actors are increasingly relying on *living-off-the-land* techniques and trusted tooling to establish persistent access on Windows endpoints. One campaign used weaponized Windows shortcut (`.LNK`) files disguised as investment-related PDFs to deliver **MoonPeak**, a remote access trojan assessed as a **XenoRAT** variant and linked to North Korea–aligned activity targeting South Korean investors and cryptocurrency traders. Opening the `.LNK` launches an obfuscated PowerShell-driven, multi-stage infection chain while displaying a decoy PDF; analysis also tied payload hosting to attacker-controlled GitHub repositories, reflecting “Living Off Trusted Sites (LOTS)” tradecraft. A separate dual-wave intrusion chain used phishing emails masquerading as *Greenvelope* invitations to steal webmail credentials (e.g., Outlook, Yahoo, AOL), then used the compromised accounts to register for and silently deploy **LogMeIn Resolve** (formerly *GoTo Resolve*) for persistent remote access. The installer (`GreenVelopeCard.exe`) was described as signed and configured to connect to attacker-controlled infrastructure, with follow-on actions including modifying service settings for elevated access and creating hidden scheduled tasks for resilience. Related threat intelligence reporting also highlighted broader “rogue RMM” abuse trends, including **Remcos** and **NetSupport Manager** delivery via paste-and-run lures and PowerShell/`cmd` execution chains (including use of the `finger` utility to fetch remote payloads), underscoring that adversaries are operationalizing legitimate remote administration software as a stealthy backdoor mechanism.
Jun 29, 2026
Researchers documented two separate but related **LNK-driven intrusion chains** that used shortcut files as the initial lure to fetch additional malware from attacker-controlled infrastructure. In one campaign targeting organizations in the **Arabian Gulf region**, a China-nexus threat actor used a Middle East conflict-themed ZIP archive containing an LNK file that downloaded a malicious CHM file and ultimately deployed a **PlugX** backdoor. The infection chain progressed through a second LNK, a TAR archive, DLL sideloading, and a shellcode loader before installing PlugX with persistence under a fake Microsoft Display Broker path and service name. The malware used RC4-encrypted components, API hooking, reflective DLL loading, corrupted PE headers, and support for **TCP, HTTPS, UDP, and DoH** communications, with a decrypted command-and-control endpoint at `91.193.17[.]117:443` and plugins for keylogging, shell access, screen capture, registry, service, and network operations. A second investigation exposed a live **LNK-to-DLL-to-.NET RAT** operation staged from an open Apache directory on `wildishadventure[.]com/secure9/` and `171.22.182[.]231/secure9/`, where researchers recovered weaponized LNK files, custom DLL downloaders, backup files, and a final payload named `RemoteMgmt.Agent.exe`. That chain abused the legacy `ActiveXObject('htmlfile')` technique to force Windows to retrieve DLLs over UNC paths, then delivered a custom .NET 4.8 remote access trojan that supported command execution, token-based authentication, JSON-over-raw-TCP C2 over port 443, reconnect-based persistence, and logging to `%TEMP%\rmgmt_agent.log`. Operational security failures including exposed directory indexing, `.old` backups, test builds, and unstripped internal names allowed investigators to reconstruct the malware’s development workflow and identify infrastructure spanning **BlueVPS**, **Namecheap**, and **Cloudflare**.
Jun 29, 2026