Russian Hackers Use CTRL Toolkit to Hijack RDP Sessions

Key Takeaways

• A previously unknown Russian-linked remote access toolkit, named “CTRL,” is actively hijacking Remote Desktop Protocol (RDP) sessions on Windows systems.
• The sophisticated .NET framework combines phishing, keylogging, reverse tunneling, and persistence mechanisms to facilitate credential theft and covert access.
• CTRL has not appeared in public threat intelligence feeds, suggesting private use by a Russian-speaking developer.
• The toolkit installs RDP Wrapper and patches termsrv.dll to enable hidden, concurrent RDP sessions without user detection.
• Mitigation involves monitoring for specific registry entries, scheduled tasks, RDP Wrapper installations, and suspicious network connections to identified infrastructure.

A newly identified remote access toolkit, dubbed “CTRL,” is being actively deployed by Russian-linked threat actors to compromise Windows systems. This sophisticated malware is designed to hijack Remote Desktop Protocol (RDP) sessions and surreptitiously exfiltrate user credentials.

Analysis by Censys ARC reveals that CTRL is a custom .NET framework, integrating multiple attack capabilities including phishing, keylogging, reverse tunneling, and robust persistence mechanisms into a cohesive attack chain.

The discovery of CTRL occurred during routine open directory scanning when Censys ARC researchers uncovered a malicious LNK file and three associated .NET payloads linked to the domain hui228[.]ru. At the time of its analysis, the framework was absent from public malware repositories and major threat intelligence feeds, indicating its potential use in targeted, private operations rather than widespread distribution.

Remote Access Toolkit “CTRL”

Researchers have attributed the operation to a Russian-speaking developer, based on the presence of Russian-language strings within the toolkit, various development artifacts, and details pertaining to the supporting infrastructure. Censys ARC also noted that CTRL is engineered for modern Windows environments, including recent releases, underscoring its active development and ongoing refinement.

The attack sequence initiates with a weaponized shortcut file, cleverly disguised as a private key archive folder. This LNK file executes hidden PowerShell code, which then decodes and launches a multi-stage loader entirely in memory, avoiding disk-based indicators.

Censys ARC found that the malware strategically stores its payloads within Windows registry keys under Explorer-related paths, allowing them to blend in with legitimate system data. Following this, the stager proceeds to create scheduled tasks, configure firewall rules, download additional components, and prepare the compromised system for sustained access.

The report further details CTRL’s capability to bypass User Account Control (UAC) through a registry hijack technique combined with a signed Microsoft binary. Once elevated, the malware installs the remaining components of the toolkit and ensures persistence across system reboots.

RDP Hijacking and Credential Theft

A critical component of CTRL’s functionality is its capacity for enabling hidden RDP access. According to the Censys ARC report, the malware modifies termsrv.dll and installs RDP Wrapper. This setup allows attackers to establish concurrent remote desktop sessions without alerting the legitimate user, maintaining covert control.

The toolkit also incorporates a highly deceptive fake Windows Hello PIN prompt. Censys researchers observed that this phishing window meticulously mimics the authentic Windows interface, displaying the victim’s actual account details and even validating stolen PINs against the legitimate authentication process to enhance its credibility.

Additionally, CTRL operates a background keylogger and supports direct command execution via a named pipe named ctrlPipe. This mechanism allows operators to control the infected machine locally through the compromised RDP session, bypassing the need for a more overt, traditional command-and-control (C2) channel that might trigger network defenses.

To further reduce its network footprint and visibility, CTRL leverages Fast Reverse Proxy (FRP) to establish reverse tunnels back to attacker-controlled infrastructure. Censys ARC identified infrastructure associated with the IPs 194.33.61.36, 109.107.168.18, and the domain hui228[.]ru in connection with the malware. This design helps the attackers evade detection by avoiding typical beaconing patterns commonly associated with commodity remote access trojans, allowing for stealthy RDP and shell access while leaving minimal network traces.

Indicators of Compromise

• IP Addresses:
  • 194.33.61.36: Used for payload hosting and as an FRP relay server.
  • 109.107.168.18: Functions as a secondary FRP relay on port 7000.
• Domain: hui228[.]ru: Utilized for command-and-control via dynamic DNS.
• Registry Entry: Malicious payload stored as ShellStateVersion1 at HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer.
• Files:
  • C:Tempkeylog.txt: Stores captured keystrokes.
  • C:ProgramDatafrpfrpc.toml: Contains hidden FRP configuration and C2 tokens.
• Named Pipe: ctrlPipe: Used for local command-and-control communication.

What You Should Do

• Monitor for unusual binary data written to Explorer-related registry keys.
• Scrutinize newly created or modified scheduled tasks, especially those with obfuscated commands or unusual execution paths.
• Detect and investigate the installation of RDP Wrapper or modifications to termsrv.dll.
• Look for the creation of hidden administrator-level accounts or elevated privileges granted to suspicious processes.
• Monitor for outbound FRP traffic and any suspicious network connections to the identified infrastructure (194.33.61.36, 109.107.168.18, hui228[.]ru).
• Implement strong multi-factor authentication for RDP and all critical systems.
• Regularly audit RDP settings and user accounts for unauthorized changes.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.