Back Thehackernews

Russian CTRL Toolkit Delivered via Malicious LNK Files Hijacks RDP via FRP Tunnels

Thehackernews •[email protected] (The Hacker News) • March 30, 2026

New 2026 Ponemon research reveals where mature identity programs still fall short and what leading organizations are doing to close the gap.

AI agents need identity, but most teams are still figuring out how to implement it. This session cuts through the noise with a practical, production-ready framework.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Russian Hackers Use CTRL Toolkit for RDP Hijacking via FRP Tunnels Russian hackers have deployed a new remote access toolkit named 'CTRL' to hijack Remote Desktop Protocol (RDP) sessions. This toolkit utilizes FRP-based reverse tunnels to gain stealthy access to compromised Windows systems. The CTRL toolkit integrates methods for credential theft, keylogging, and RDP exploitation into a unified post-exploitation framework. Currently, it remains undetected by many public malware scanners, posing a significant risk to organizations using RDP. The attack primarily targets Windows systems, which are vulnerable to this new method of exploitation. The toolkit's silent operation allows attackers to maintain hands-on access without raising alarms. Organizations relying on RDP should be particularly vigilant against this emerging threat. The situation is ongoing, with no reported mitigation strategies available yet. 7 sources 70

Extracted Entities

Russian CTRL Toolkit Delivered via Malicious LNK Files Hijacks RDP via FRP Tunnels

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Tools (1)