Kaspersky said its network security product detected more than 2.1mn attempts to use hacking tools inside corporate networks over six months, with Cobalt Strike the most common.
The figures come from detection alerts in Kaspersky Anti Targeted Attack (KATA), its network detection product, between April and September 2026, according to a statement from Kaspersky. The data cover only Kaspersky customers who agreed to share statistics, and some detections may come from authorised security tests, the company said.
Which hacking tools were detected most often?
Kaspersky recorded 2,171,513 hacking tool detections in the period. The most frequent were Cobalt Strike, with 136,084 detections, NetExec, with 129,560, and SQLMap, with 107,697. All three are legitimate security-testing tools that attackers also use to move through networks, gather credentials and break into databases.
Attackers increasingly avoid malware that security software can spot, and instead use administrative tools already present on corporate systems to move between machines undetected, the company said.
What does it mean for companies?
“Since advanced hacking tools may bypass endpoint defences, deploying Network Detection and Response (NDR) solution is critical to exposing silent anomalies,” said Aren Torosyan, a product manager at Kaspersky. The company sells such a product, and the figures have not been independently verified.
The findings echo warnings from security researchers that the misuse of legitimate tools, rather than custom malware, now drives many corporate intrusions, a risk growing alongside Africa’s fast expansion of digital payments.
FAQ
What is lateral movement in a cyber attack?
It is the stage in which attackers who have entered one machine move to others in the same network to find credentials and valuable data.
What is Cobalt Strike?
Cobalt Strike is a commercial tool for testing network security that is also widely misused by criminal hackers.
How many hacking tool detections did Kaspersky report?
Kaspersky reported 2,171,513 detections between April and September 2026 among customers who share data with it.
