Recent statistics compiled from detection alerts within Kaspersky Anti Targeted Attack (KATA)* reveal the hacking tools most often used for lateral movement across enterprise infrastructures, highlighting the pressing need for reliable network security solutions to protect corporate environments.
Recent investigations into cyber-espionage groups show that attackers increasingly avoid detectable malware, choosing instead to blend into legitimate corporate network traffic. By weaponising dual-use tools and administrative utilities already present in the system, they move laterally across the domain undetected to harvest credentials and locate high-value assets. In this era of silent intrusion, Kaspersky shares insights into the most frequently used hacking tools to help organisations defend their networks.
For a decade, KATA, Kaspersky’s mature NDR solution, has been delivering comprehensive anti-APT protection. It features advanced threat detection, in-depth network traffic analysis, and centralised incident response to ensure full visibility across the entire network. Equipped with nearly 12,500 network detection rules in its database, KATA detects an average of 312,705 potential attacks daily.
For the period of 6 months, April to September 2026, the solution detected 2,171,513 hacking tool usage attempts. The following types of tools were detected most frequently:
HackTool.Cobalt – 136,084 detections. While designed for security assessments, Cobalt Strike is also frequently used by malicious actors across various attack stages, including post-exploitation, lateral movement, and similar activities.
HackTool.NetExec – 129,560 detections. NetExec is used for automated network security assessments and discovering poorly secured network services. Its capabilities can also be exploited by attackers for reconnaissance and gaining system access.
HackTool.SQLMap – 107,697 detections. The SQLMap tool is used to automate the detection and exploitation of SQL injection vulnerabilities, which can allow unauthorised access to databases via web applications.
“Since advanced hacking tools may bypass endpoint defences, deploying Network Detection and Response (NDR) solution is critical to exposing silent anomalies and neutralising advanced attacks,” says Aren Torosyan, Product Manager at Kaspersky. “This year, we are proudly celebrating the 10th anniversary of KATA. Over this decade of innovation, backed by deep infrastructure expertise and rigorous research, KATA has established itself as a highly effective solution, helping clients worldwide protect their environments from even the most advanced, hidden threats across networks and endpoints. With the transition to the Open Single Management Platform planned for next year, advanced NDR capabilities will become even more comprehensive and accessible to security teams”.
To get full information about Kaspersky Anti Targeted Attack and request a demo, please visit the website.
