Between April and September 2026, Kaspersky's Anti Targeted Attack solution recorded 2,171,513 hacking tool usage attempts, according to recent statistics compiled by the company. The data highlights the utilities most frequently used by attackers to move laterally across enterprise infrastructures.
Most Frequent Detections
Kaspersky reported that its Kaspersky Anti Targeted Attack solution detected 2,171,513 hacking tool usage attempts during the six-month period from April to September 2026. The most frequently detected utilities included HackTool.Cobalt with 136,084 detections, HackTool.NetExec with 129,560 detections, and HackTool.SQLMap with 107,697 detections.
According to the company, attackers increasingly avoid detectable malware to blend into legitimate corporate network traffic. By weaponising administrative utilities and dual-use tools already present in systems, malicious actors move laterally across domains to harvest credentials and locate high-value assets.
Network Detection and Response
Kaspersky stated that KATA features nearly 12,500 network detection rules in its database and detects an average of 312,705 potential attacks daily. Aren Torosyan, Product Manager at Kaspersky, noted that advanced hacking tools may bypass endpoint defences, making Network Detection and Response solutions critical.
Key facts and where they come from
- Kaspersky Anti Targeted Attack detected 2,171,513 hacking tool usage attempts between April and September 2026.
For the period of 6 months, April to September 2026, the solution detected 2,171,513 hacking tool usage attempts
- HackTool.Cobalt recorded 136,084 detections during the period.
HackTool.Cobalt – 136,084 detections.
- HackTool.NetExec recorded 129,560 detections.
HackTool.NetExec – 129,560 detections.
- HackTool.SQLMap recorded 107,697 detections.
HackTool.SQLMap – 107,697 detections.
