Summary of findings and why they matter
Kaspersky’s Anti Targeted Attack (KATA) telemetry from April–September 2026 shows 2,171,513 attempts to use common offensive tools inside corporate networks. The most frequently detected tool families—Cobalt Strike, NetExec, and SQLMap—account for hundreds of thousands of detections each and reveal a clear attacker preference: reuse of dual-purpose administrative utilities and legitimate-facing tooling to blend with normal traffic and move laterally without immediate detection.
How attackers leverage dual-purpose tools for lateral movement
Attackers prefer tools that mimic legitimate administrative workflows because they reduce noisy, signatureable behavior. For example, Cobalt Strike provides post-exploitation capabilities such as remote command execution, pivoting, and staged payloads; Defenders often see their beacons masquerading as routine traffic. NetExec-style tools automate remote task execution across hosts, which attackers adapt to enumerate systems and schedule privilege escalation attempts. SQLMap targets web-facing database layers to extract credentials and connection strings attackers reuse to hop between application and database hosts.
Concrete detection numbers and what they imply
KATA runs roughly 12,500 network detection rules and flags an average of 312,705 potential attacks per day. Between April and September 2026 it recorded these top counts:
HackTool.Cobalt — 136,084 detections. Frequent in post-exploitation phases; high-risk because it supports encrypted beacons and multiple pivot techniques.
HackTool.NetExec — 129,560 detections. Often seen during automated discovery and lateral task scheduling; indicates attackers scripting internal reconnaissance.
HackTool.SQLMap — 107,697 detections. Appears during web-application exploitation and credential harvesting that precedes lateral movement.
Step-by-step attacker workflow implied by the data
From the detection patterns, a typical attack timeline emerges:
1) Initial access: Exploit a vulnerable web-facing service (often automated SQLMap scans) or compromise credentials through phishing.
2) Credential harvesting: Use SQLMap or capture tokens from web apps to obtain database or service account credentials.
3) Lateral execution: Deploy NetExec-like automation to run reconnaissance and scheduled jobs across multiple hosts.
4) Persistence and C2: Stage lightweight implants or use Cobalt Strike beacons to maintain encrypted command-and-control and enable further pivoting.
5) Data staging and exfiltration: Aggregate sensitive files on a staging host, compress and exfiltrate via covert channels to blend with legitimate uploads.
Detection challenges and why NDR matters
Endpoint sensors often miss these attacks because the tools either use signed binaries, common administration ports, or encrypted channels. Network Detection & Response (NDR) fills gaps by analyzing protocol flows, identifying anomalous lateral patterns, and correlating multi-host behaviors across time. KATA’s 12,500 rules and centralized event correlation enable it to expose slow, low-and-slow intrusions that would otherwise bypass endpoint signature checks.
Actionable defensive steps for security teams
1) Prioritize network telemetry: Collect and retain flow and packet metadata for at least 90 days to identify slow lateral movement.
2) Hunt for tool-specific indicators: Define behavioral rules for beacon timing, atypical authentication patterns, and high-rate remote execution commands rather than relying solely on file hashes.
3) Segment and apply least privilege: Reduce the blast radius by enforcing microsegmentation and minimizing service account privileges used by applications.
4) Harden web applications: Regularly run authenticated and unauthenticated scans to remove SQL injection and exposed admin interfaces that enable initial access via tools like SQLMap.
5) Test detection and response: Simulate post-exploitation workflows (eg, controlled Cobalt Strike emulation) inside a lab to validate NDR rule coverage and incident playbooks.
Examples and quick wins
Example 1: Detect NetExec abuse by flagging rapid sequential remote command executions that originate from a single internal host and target dozens of unique endpoints within a short window—this pattern rarely appears in regular operational tasks and is an efficient hunting rule.
Example 2: Identify Cobalt Strike by correlating low-volume, periodic outbound connections with spikes in internal process network usage and unusual DNS query strings; Combining these signals reduces false positives from benign beaconing tools.
What the KATA anniversary signals about future NDR evolution
KATA’s decade of development and Kaspersky’s plan to move to an Open Single Management Platform indicate two trends: (1) NDR will increasingly integrate with endpoint and cloud telemetry for unified investigation, and (2) vendors will focus on packaged behavioral analytics that surface stealthy lateral movement without overwhelming analysts with noise. Organizations should expect NDR tooling to shift from raw alerts to prioritized investigative contexts that map attacker objectives across assets.
Recommended playbook for a suspected lateral movement incident
1) Isolate suspected pivot hosts at the network layer and snapshot volatile memory for forensic analysis. 2) Query internal authentication logs for abnormal account usage and newly created service accounts. 3) Hunt for web application anomalies and SQL injection traces tied to the initial compromise window. 4) Validate persistence mechanisms (scheduled tasks, remote services) and remove unauthorized entries. 5) Rotate credentials and secrets tied to compromised services and enforce multifactor authentication where possible.
Key takeaways
Widespread detection of Cobalt Strike, NetExec, and SQLMap shows attackers rely on legitimate-appearing tooling to carry out credential theft and lateral movement. Network-focused detection that looks for behavioral patterns, not just file signatures, gives defenders the best chance to detect and disrupt these campaigns early. Implementing segmentation, prioritized NDR telemetry, and targeted hunt rules yields high-impact, relatively low-effort improvements in detecting lateral movement.
Be the first to comment