Kaspersky records 2.17 million hacking-tool detections in six months

Kaspersky’s April–September 2026 records highlight Cobalt Strike, NetExec and SQLMap. Detection counts are not confirmed attacks and may include authorised security testing.

Dji Banner Inside Article - 728x90

Statistics compiled from Kaspersky Anti Targeted Attack, or KATA, detection records show which hacking tools were most frequently identified in corporate networks in connection with lateral movement. The company says the findings underline the importance of dependable network-security solutions. The total refers to detection alerts, not a count of confirmed attacks: some activity may have come from authorised security assessments and legitimate penetration tests.

9 November 2026 — Recent research into cyberespionage groups indicates that attackers increasingly avoid malware that could expose their presence, instead seeking to blend into legitimate corporate network traffic. By misusing dual-purpose tools and administrative utilities already available in systems, they move laterally through a domain to capture credentials and identify valuable targets without being detected. Against this backdrop, Kaspersky has shared findings about frequently detected hacking tools to help organisations protect their networks.

The company describes KATA as an advanced network detection and response, or NDR, solution that has provided protection against advanced persistent threats for ten years. It combines advanced threat detection, detailed network traffic analysis and centralised incident-response capabilities to provide visibility across networks. Its database contains approximately 12,500 network detection rules. Kaspersky reports an average of 312,705 potential-attack detections per day, a separate metric from the six-month hacking-tool total. Between April and September 2026, KATA recorded 2,171,513 detections involving hacking-tool use.

The most frequently detected tool categories

HackTool.Cobalt — 136,084 detections. Cobalt Strike was designed for security assessments but is also misused by malicious actors for post-exploitation activities, lateral movement within networks and other attack stages.

HackTool.NetExec — 129,560 detections. NetExec automates network security assessments and identifies insufficiently secured network services. Its capabilities can also be misused for reconnaissance and gaining access to systems.

HackTool.SQLMap — 107,697 detections. SQLMap automates detection and exploitation of SQL-injection vulnerabilities, which can allow unauthorised database access through web applications.

Network visibility and incident response

Kaspersky Product Manager Aren Torosyan said:

“Because advanced hacking tools can bypass endpoint security solutions, using Network Detection and Response solutions is critical for uncovering quiet anomalies and neutralising advanced attacks. We are proud to celebrate KATA’s tenth anniversary this year. Over a decade of innovation supported by deep infrastructure expertise and extensive research, KATA has proved a highly effective solution, helping customers worldwide protect their environments against the most advanced and concealed threats targeting networks and endpoints. With the move to the Open Single Management Platform planned for next year, advanced NDR capabilities will become more comprehensive and easier for security teams to use.”

Further information about Kaspersky Anti Targeted Attack and demo requests is available on the company’s website.

What the figures mean

The statistics are based on detection alerts from Kaspersky products collected from users who agreed to provide statistical data to Kaspersky Security Network. Some detections may have arisen during authorised security assessments and legal penetration tests. The reported total must therefore not be presented as 2.17 million successful intrusions, unique victims or confirmed criminal attacks. It describes alerts involving tools that can be used for either legitimate security work or malicious activity.

About Kaspersky

Founded in 1997, Kaspersky is a global cybersecurity and digital privacy company. It says it has protected more than one billion devices against emerging cyberthreats and targeted attacks. The company applies its threat intelligence and security expertise to products and services for individuals, businesses, critical infrastructure and governments worldwide. Its portfolio includes digital-life protection for personal devices, specialised business security products and services, and Cyber Immune solutions for sophisticated and evolving digital threats. It serves millions of individuals and approximately 200,000 corporate customers. Further information is available at www.kaspersky.com.

Source: Kaspersky press release.