Kaspersky detects over 2.17 million hacking tool attempts on corporate networks in 6 months

Cobalt Strike leads with 136,000 attempts as attackers exploit legitimate tools

Threats blend into normal traffic to move through corporate networks undetected

A cybersecurity concept image [Getty Images Bank]

More than 2.17 million attempts to use hacking tools against corporate networks were detected over the past six months, with cybercriminals increasingly exploiting legitimate software to infiltrate internal systems and access sensitive assets, new data shows.

Global cybersecurity firm Kaspersky said Wednesday it analyzed detection alerts from KATA, its network detection and response solution, covering April through September, and identified 2,171,513 hacking tool use attempts inside corporate networks.

According to Kaspersky, attackers have been moving away from easily detected malware and toward legitimate system administration and security auditing tools. By blending into normal network traffic, they evade security defenses while moving laterally through corporate networks, harvesting account credentials and gaining access to critical systems and assets.

Kaspersky identified the three most frequently attempted hacking tools as Cobalt Strike, NetExec and SQLMap.

Cobalt Strike accounted for 136,084 detected attempts. Originally developed for security assessments, the tool has been widely abused by attackers for lateral movement within corporate networks.

NetExec followed with 129,560 detections, and SQLMap was detected 107,697 times. NetExec is abused to probe vulnerable network services and gain system access, while SQLMap exploits weaknesses in web applications to gain unauthorized access to databases.

KATA is an NDR solution designed to detect and respond to sophisticated targeted attacks. Built on technology Kaspersky has developed over the past decade, it provides threat detection, network traffic analysis, centralized incident response and network-wide visibility. The solution currently uses about 12,500 network detection rules and detects an average of 312,705 potential attacks per day.

Aren Toroshyan, a Kaspersky product manager, said advanced hacking tools can bypass endpoint security defenses, making it critical to catch anomalies through network detection and response. "Next year, we plan to transition to an Open Single Management Platform to make advanced NDR capabilities more widely and easily accessible," Toroshyan said.

Lee Hyo-eun, head of Kaspersky's Korea office, said attacks that exploit legitimate management tools to infiltrate corporate networks and steal sensitive data pose a serious threat to South Korean businesses and public institutions. "We will support early detection and blocking of covert intrusions and protection of core infrastructure through AI-based network detection and response technology," Lee said.

chami@heraldcorp.com