Kaspersky reveals the most used lateral movement utilities
Recent statistics compiled from detection alerts within Kaspersky Anti Targeted Attack [1] (KATA) reveal the hacking tools most often used for lateral movement across enterprise infrastructures, highlighting the pressing need for reliable network security solutions to protect corporate environments.
Recent investigations into cyber-espionage groups show that attackers increasingly avoid detectable malware, choosing instead to blend into legitimate corporate network traffic. By weaponizing dual-use tools and administrative utilities already present in the system, they move laterally across the domain undetected to harvest credentials and locate high-value assets. In this era of silent intrusion, Kaspersky shares insights into the most frequently used hacking tools to help organizations defend their networks.
For a decade, KATA, Kaspersky’s mature NDR solution, has been delivering comprehensive anti-APT protection. It features advanced threat detection, in-depth network traffic analysis, and centralized incident response to ensure full visibility across the entire network. Equipped with nearly 12,500 network detection rules in its database, KATA detects an average of 312,705 potential attacks daily.
For the period of April to September 2026 the solution detected 2,171,513 hacking tool usage attempts[2]. The following types of tools were detected most frequently:
HackTool.Cobalt – 136,084 detections
While designed for security assessments, Cobalt Strike is also frequently used by malicious actors across various attack stages, including post-exploitation, lateral movement, and similar activities.
HackTool.NetExec – 129,560 detections
NetExec is used for automated network security assessments and discovering poorly secured network services. Its capabilities can also be exploited by attackers for reconnaissance and gaining system access.
HackTool.SQLMap – 107,697 detections
The SQLMap tool is used to automate the detection and exploitation of SQL injection vulnerabilities, which can allow unauthorized access to databases via web applications.
“Since advanced hacking tools may bypass endpoint defenses, deploying Network Detection and Response (NDR) solution is critical to exposing silent anomalies and neutralizing advanced attacks,” says Aren Torosyan, Product Manager at Kaspersky. “This year, we are proudly celebrating the 10th anniversary of KATA. Over this decade of innovation, backed by deep infrastructure expertise and rigorous research, KATA has established itself as a highly effective solution, helping clients worldwide protect their environments from even the most advanced, hidden threats across networks and endpoints. With the transition to the Open Single Management Platform planned for next year, advanced NDR capabilities will become even more comprehensive and accessible to security teams”.
To get full information about Kaspersky Anti Targeted Attack and request a demo, please visit: https://www.kaspersky.com/enterprise-security/anti-targeted-attack-platform
About Kaspersky
Kaspersky is a global cybersecurity and digital privacy company founded in 1997. With over a billion devices protected to date from emerging cyberthreats and targeted attacks, Kaspersky’s deep threat intelligence and security expertise is constantly transforming into innovative solutions and services to protect individuals, businesses, critical infrastructure and governments around the globe. The company’s comprehensive security portfolio includes leading digital life protection for personal devices, specialized security products and services for companies, as well as Cyber Immune solutions to fight sophisticated and evolving digital threats. We help millions of individuals and nearly 200,000 corporate clients protect what matters most to them. Learn more at www.kaspersky.com.
[1] These statistics are based on detection alerts from Kaspersky products, collected from users who consented to provide statistical data to Kaspersky Security Network.
[2] Some of the detections may be attributed to authorized security assessments