Strapi plugins exploit Redis and PostgreSQL via postinstall scripts, enabling persistent access and data theft.
Russian CTRL toolkit spread via malicious LNK files in February 2026, routing C2 through FRP-tunneled RDP to evade detection.