{
  "Name": "ControlR",
  "Category": "RMM",
  "Description": "ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems.",
  "Author": "Swachchhanda Shrawan Poudel",
  "Created": "2026-08-17",
  "LastModified": "2026-08-18",
  "Details": {
    "Website": "https://controlr.app/",
    "PEMetadata": [
      {
        "Filename": "ControlR.Agent.Installer.exe",
        "OriginalFileName": "ControlR.Agent.Installer.dll",
        "Description": "ControlR.Agent.Installer",
        "Product": "ControlR.Agent.Installer"
      },
      {
        "Filename": "ControlR.Agent.exe",
        "OriginalFileName": "ControlR.Agent.dll",
        "Description": "ControlR.Agent",
        "Product": "ControlR.Agent"
      },
      {
        "Filename": "ControlR.DesktopClient.exe",
        "OriginalFileName": "ControlR.DesktopClient.dll",
        "Description": "ControlR.DesktopClient",
        "Product": "ControlR.DesktopClient"
      }
    ],
    "Privileges": "SYSTEM/root",
    "Free": true,
    "Verification": "Code-signed by Bitbound",
    "SupportedOS": [
      "Windows",
      "MacOS",
      "Linux"
    ],
    "Capabilities": [
      "Remote desktop management",
      "Remote desktop view",
      "File transfer",
      "Command execution",
      "Activity monitoring"
    ],
    "InstallationPaths": [
      "C:\\Program Files\\ControlR\\*\\ControlR.Agent.exe",
      "C:\\Program Files\\ControlR\\*\\DesktopClient\\ControlR.DesktopClient.exe",
      "C:\\Program Files\\ControlR\\*\\DesktopClient\\ControlR.DesktopClient.dll",
      "C:\\ProgramData\\ControlR\\",
      "/usr/local/bin/ControlR/*",
      "/Library/Application Support/ControlR/*",
      "/Applications/ControlR.app",
      "/Applications/ControlR.*.app"
    ]
  },
  "Artifacts": {
    "Disk": [
      {
        "File": "*\\ControlR.Agent.Installer.exe",
        "Description": "ControlR agent installer dropped and executed by threat actors.",
        "OS": "Windows"
      },
      {
        "File": "C:\\Program Files\\ControlR\\*\\ControlR.Agent.exe",
        "Description": "ControlR agent binary installed on Windows.",
        "OS": "Windows"
      },
      {
        "File": "C:\\ProgramData\\ControlR\\*\\appsettings.json",
        "Description": "ControlR agent configuration file on Windows.",
        "OS": "Windows"
      },
      {
        "File": "C:\\ProgramData\\ControlR\\*\\Logs\\ControlR.Agent\\LogFile*.log",
        "Description": "ControlR agent log files on Windows.",
        "OS": "Windows"
      },
      {
        "File": "C:\\ProgramData\\ControlR\\*\\Logs\\ControlR.DesktopClient\\LogFile*.log",
        "Description": "ControlR desktop client log files on Windows.",
        "OS": "Windows"
      },
      {
        "File": "/usr/local/bin/ControlR/*/ControlR.Agent",
        "Description": "ControlR agent binary installed on Linux.",
        "OS": "Linux"
      },
      {
        "File": "/etc/controlr/*/appsettings.json",
        "Description": "ControlR agent configuration file on Linux (root).",
        "OS": "Linux"
      },
      {
        "File": "/etc/systemd/system/controlr.agent*.service",
        "Description": "ControlR agent systemd service unit file on Linux.",
        "OS": "Linux"
      },
      {
        "File": "/var/log/controlr/*/ControlR.Agent/LogFile*.log",
        "Description": "ControlR agent log files on Linux (root).",
        "OS": "Linux"
      },
      {
        "File": "~/.controlr/*/logs/ControlR.Agent/LogFile*.log",
        "Description": "ControlR agent log files on Linux (user context).",
        "OS": "Linux"
      },
      {
        "File": "/Library/Application Support/ControlR/*/ControlR.Agent",
        "Description": "ControlR agent binary installed on macOS.",
        "OS": "MacOS"
      },
      {
        "File": "/Applications/ControlR.app",
        "Description": "Default ControlR desktop client app bundle on macOS.",
        "OS": "MacOS"
      },
      {
        "File": "/Applications/ControlR.*.app",
        "Description": "Instance-specific ControlR desktop client app bundle on macOS.",
        "OS": "MacOS"
      },
      {
        "File": "/Library/LaunchDaemons/app.controlr.agent*.plist",
        "Description": "ControlR agent launchd plist files on macOS.",
        "OS": "MacOS"
      },
      {
        "File": "/Library/LaunchAgents/app.controlr.desktop*.plist",
        "Description": "ControlR desktop client launchd plist files on macOS.",
        "OS": "MacOS"
      },
      {
        "File": "/var/log/controlr/*/ControlR.Agent/LogFile*.log",
        "Description": "ControlR agent log files on macOS (root).",
        "OS": "MacOS"
      },
      {
        "File": "~/.controlr/*/logs/ControlR.Agent/LogFile*.log",
        "Description": "ControlR agent log files on macOS (user context).",
        "OS": "MacOS"
      }
    ],
    "EventLog": [],
    "Registry": [
      {
        "Path": "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\ControlR",
        "Description": "Default ControlR uninstall registry key on Windows."
      },
      {
        "Path": "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\ControlR (*)",
        "Description": "Instance-specific ControlR uninstall registry key on Windows."
      }
    ],
    "Network": [
      {
        "Description": "ControlR agent installer is downloaded from the official demo tenant domain.",
        "Domains": [
          "demo.controlr.app"
        ],
        "Ports": [
          443
        ]
      }
    ]
  },
  "References": [
    "https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/",
    "https://controlr.app/",
    "https://github.com/bitbound/ControlR"
  ],
  "Acknowledgement": [
    {
      "Person": "Swachchhanda Shrawan Poudel",
      "Handle": "@_swachchhanda_"
    }
  ]
}