Kaspersky’s latest detection data highlights how attackers use legitimate security and administration tools to move quietly through corporate networks. Between April and September 2026, Kaspersky Anti Targeted Attack (KATA) detected 2,171,513 attempts involving hacking tools. The findings illustrate why network monitoring matters: attackers may exploit tools that administrators also use for legitimate security work, making suspicious activity harder to distinguish from normal operations.
Why attackers use legitimate tools for lateral movement
Rather than relying only on malware, cyber espionage groups can abuse dual-use tools and utilities already present in an organization’s environment. After gaining access, attackers may use them to discover systems, obtain credentials, and move laterally across a domain. Because these tools can resemble routine administrative activity, network-level visibility can help security teams identify unusual behavior that endpoint defenses may not catch on their own.
Most frequently detected hacking tools
- HackTool.Cobalt — 136,084 detections. Cobalt Strike is designed for security assessments, but attackers also use it during post-exploitation activity, including lateral movement within a network.
- HackTool.NetExec — 129,560 detections. NetExec can automate network security assessments and identify weakly configured services. Malicious actors may misuse its capabilities for reconnaissance and unauthorized access.
- HackTool.SQLMap — 107,697 detections. SQLMap automates the identification and exploitation of SQL injection vulnerabilities, which can expose databases through vulnerable web applications.
These figures count detections recorded by KATA during the six-month period; they do not necessarily represent unique organizations or confirmed successful breaches.
What Kaspersky KATA does
KATA is a network detection and response (NDR) solution designed to help organizations identify advanced threats. It combines threat detection, network traffic analysis, and centralized incident response capabilities. Kaspersky reports that its detection database contains approximately 12,500 network detection rules and that the solution identifies an average of 312,705 potential attacks per day.
By analyzing network activity, an NDR solution can help security teams investigate suspicious connections and activity across systems. This is especially relevant when attackers use tools that may otherwise appear legitimate in an organization’s environment.
Why network detection and response matters
When a familiar administration or testing utility appears in an unexpected context, its presence alone may not explain whether it is being used legitimately. Security teams can assess activity by examining where the tool ran, which accounts and systems were involved, and whether the surrounding network traffic matches expected behavior. NDR provides a broader view of communications between systems, supporting investigation of potential lateral movement and other signs of compromise.
Kaspersky’s plans for the platform
Kaspersky Product Manager Aren Torosyan said that NDR can help security teams identify subtle anomalies and respond to advanced attacks that may evade endpoint security. He also noted that KATA is expected to transition to an Open Single Management Platform, with the aim of making its advanced NDR capabilities more accessible to security teams.
Source: Kaspersky; figures cover detections recorded from April through September 2026. Original source credit: BYZHA, Beyaz Haber Ajansi.
Be the first to comment