Executive Summary
Censys ARC has identified a previously undocumented Russian remote access toolkit dubbed 'CTRL' (or Polycue) that integrates modular post-exploitation capabilities into a cohesive framework. The toolkit is distributed via socially engineered LNK files and utilizes a layered execution chain involving PowerShell loaders, binary registry storage, and in-memory .NET assembly loading to evade traditional disk-based detection.
The framework features a highly sophisticated Windows Hello phishing module that validates captured PINs against the actual OS authentication system using UI automation. It also enables persistent remote access by patching the Windows Remote Desktop service and establishing reverse tunnels via Fast Reverse Proxy (FRP). The associated infrastructure, primarily hosted on Partner Hosting LTD, appears freshly provisioned and was unpatched against major SSH vulnerabilities at the time of discovery.
This discovery is significant as the CTRL toolkit's artifacts were absent from major public threat intelligence repositories, suggesting it is currently a private or low-volume toolset. Its reliance on local named pipes and reverse tunneling minimizes network-detectable beaconing, making it a potent threat for hands-on-keyboard operations and persistent data exfiltration.