Kaspersky logs 2.17m lateral-movement tool detections in six months
Kaspersky has published detection data from its Anti Targeted Attack (KATA) network detection and response platform showing 2,171,513 hacking-tool usage attempts over the six months from April to September 2026. The figures, drawn from consenting users of the Kaspersky Security Network, highlight a sustained reliance by threat actors on dual-use and administrative utilities to traverse enterprise networks without triggering endpoint defences.
The release coincides with Kaspersky marking the tenth anniversary of KATA, which the company says now carries nearly 12,500 network detection rules and processes an average of 312,705 potential attack alerts each day.
The most-detected tools
Three utilities accounted for the largest share of detections. Cobalt Strike, branded internally as HackTool.Cobalt, generated 136,084 alerts. Originally developed for legitimate penetration testing and red-team engagements, the framework has become a mainstay of post-exploitation toolkits across nation-state and criminal groups alike. NetExec, recorded as HackTool.NetExec, followed with 129,560 detections; it automates the discovery of poorly secured network services and can be repurposed for reconnaissance and credential access. SQLMap, flagged 107,697 times, is designed to identify and exploit SQL injection vulnerabilities, enabling unauthorised database access via web-facing applications.
Kaspersky notes that the figures may include instances of authorised security assessments, meaning not every alert represents a genuine intrusion attempt. Even discounting a proportion of false positives, the volumes suggest that living-off-the-land techniques remain the dominant evasion strategy for sophisticated adversaries.
Aren Torosyan, product manager at Kaspersky, said: "Since advanced hacking tools may bypass endpoint defences, deploying a Network Detection and Response solution is critical to exposing silent anomalies and neutralising advanced attacks." Torosyan also referenced a planned migration to Kaspersky's Open Single Management Platform in 2027, which the company says will make its NDR capabilities more accessible to security teams.
Market context and competitive landscape
The NDR market has expanded rapidly as organisations accept that endpoint detection and response tools alone cannot cover east-west traffic within perimeter-less environments. Established vendors including Vectra AI, ExtraHop and Darktrace compete with network-visibility offerings from Cisco and Palo Alto Networks, while SIEM and XDR platforms increasingly absorb NDR functionality. Kaspersky's position in this market is complicated in several Western jurisdictions: the US Federal Communications Commission added the company to its Covered List in 2022, and the UK National Cyber Security Centre has issued guidance advising public-sector bodies to consider supply-chain risk when deploying Kaspersky products.
Enterprises in regions without such restrictions, particularly across Africa, the Middle East and parts of Asia-Pacific, remain active Kaspersky customers, and the South African distribution of this release reflects that focus.
Regulatory read-across
The living-off-the-land technique documented in Kaspersky's data has featured prominently in advisories issued by the US Cybersecurity and Infrastructure Security Agency, the UK NCSC and the EU's ENISA over the past two years. The EU's NIS2 Directive, which came into force for member states in October 2024, requires operators of essential services to maintain continuous monitoring capability precisely to detect the kind of lateral movement activity described here. Organisations yet to implement network-layer visibility tooling face increasing compliance exposure alongside operational risk.
Kaspersky says a full report on the KATA detection data is available via its website, alongside a product demonstration request form.