The numbers behind the alerts
Between April and September 2026 Kaspersky’s KATA platform recorded 2,171,513 attempts to use hacking tools inside corporate networks. The data comes only from users who opted in to share statistics. Three utilities topped the list: HackTool.Cobalt with 136,084 detections, HackTool.NetExec with 129,560 and HackTool.SQLMap with 107,697. These tools were originally built for legitimate testing yet are now routinely turned against company systems.
Why the shift matters
Attackers are avoiding obvious malware and instead abusing software already sitting on corporate machines. By blending into normal traffic they can hunt for credentials and valuable data without triggering endpoint alerts. The research underlines that traditional antivirus alone is no longer enough once an intruder is inside the network.
What security teams should do
“Since advanced hacking tools may bypass endpoint defenses, deploying Network Detection and Response (NDR) solution is critical to exposing silent anomalies and neutralizing advanced attacks,” says Aren Torosyan, Product Manager at Kaspersky. “This year, we are proudly celebrating the 10th anniversary of KATA. Over this decade of innovation, backed by deep infrastructure expertise and rigorous research, KATA has established itself as a highly effective solution, helping clients worldwide protect their environments from even the most advanced, hidden threats across networks and endpoints. With the transition to the Open Single Management Platform planned for next year, advanced NDR capabilities will become even more comprehensive and accessible to security teams”.
We see the same pattern in our own coverage of Kaspersky’s recent work on state-sponsored groups. For UK firms the takeaway is simple: review how your network traffic is monitored and consider adding an NDR layer before the next wave of stealthy intrusions. You can compare current VPN and security options that complement these defences on our VPN hub.
