Kaspersky logs 2.17 million hacking-tool detections in six months
KATA alerts from April to September 2026 put Cobalt Strike at the top with 136,084 detections, Kaspersky said, though the figures include authorised testing.
Kaspersky said its Kaspersky Anti Targeted Attack (KATA) solution recorded 2,171,513 attempts to use hacking tools between April and September 2026, according to dailysecu.com. The vendor published the figures on November 2, 2026.
Cobalt Strike drew the most detections of the tools listed, at 136,084. NetExec followed with 129,560 and SQLMap with 107,697.
The numbers come from detection alerts raised by users who agreed to share statistics with the Kaspersky Security Network, the company said. Kaspersky added that the counts may include authorised security assessment work, so detections do not equal the number of victim companies or of successful attacks.
According to Kaspersky, attackers abuse security assessment tools and existing administrative utilities to blend into normal corporate network traffic. The aim, the company said, is to collect account credentials and locate critical assets.
Quick answers
How many hacking-tool detections did Kaspersky record?
Kaspersky said its KATA solution detected 2,171,513 attempts to use hacking tools between April and September 2026.
Which tool was detected most often?
Cobalt Strike topped the list with 136,084 detections, ahead of NetExec at 129,560 and SQLMap at 107,697.
Do these detections represent confirmed attacks?
No. Kaspersky said the statistics may include authorised security assessment activity, so detections do not equal the number of victim companies or successful attacks.