Back Gbhackers

Russian Hackers Deploy “CTRL” for RDP Hijacking

Gbhackers •Mayura Kathir • March 30, 2026

Russian hackers are using a new remote access toolkit called “CTRL” to silently hijack Remote Desktop Protocol (RDP) sessions via FRP-based reverse tunnels, enabling stealthy, hands-on access to compromised Windows systems. The toolkit blends credential theft, keylogging, and RDP abuse into a cohesive post-exploitation framework that currently flies under the radar of public malware scanners […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Russian Hackers Use CTRL Toolkit for RDP Hijacking via FRP Tunnels Russian hackers have deployed a new remote access toolkit named 'CTRL' to hijack Remote Desktop Protocol (RDP) sessions. This toolkit utilizes FRP-based reverse tunnels to gain stealthy access to compromised Windows systems. The CTRL toolkit integrates methods for credential theft, keylogging, and RDP exploitation into a unified post-exploitation framework. Currently, it remains undetected by many public malware scanners, posing a significant risk to organizations using RDP. The attack primarily targets Windows systems, which are vulnerable to this new method of exploitation. The toolkit's silent operation allows attackers to maintain hands-on access without raising alarms. Organizations relying on RDP should be particularly vigilant against this emerging threat. The situation is ongoing, with no reported mitigation strategies available yet. 7 sources 70

Extracted Entities

Russian Hackers Deploy “CTRL” for RDP Hijacking

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (3)

Platforms (1)

Tools (1)