Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteHackers do not rely on one fixed “arsenal.” An intrusion can combine delivery methods, malware, stolen access, remote-administration software and system utilities, with each capability serving a different purpose. Some tools are built for malicious use; others are legitimate software that attackers misuse. A tool’s presence alone does not prove an intrusion—the behavior and context matter.
What do hackers use tools for?
Tools help carry out parts of an intrusion, but they are only one piece of the picture. An attacker may try to gain initial access, maintain access, move through a network, communicate with compromised systems, or steal information. A campaign can involve several of these activities; the tools and techniques vary by incident.
As an Amazon Associate I earn from qualifying purchases.
MITRE ATT&CK offers a useful way to separate an attacker’s objective from the method used to pursue it. In ATT&CK, a tactic describes the “why” behind an action, while a technique describes the “how.” A tool is a particular capability or implementation that may be used as part of that technique. MITRE’s framework helps defenders organize observations and think about detection and coverage; it is not a ranking of products or a catalogue of everything attackers use.
What kinds of tools and capabilities appear in reported intrusions?
The examples below come from specific U.S. and Canadian government advisories published in 2023 and 2024. They illustrate reported behavior, not a comprehensive list or a measure of which tools are most common today.
#1 Best Overall
| Part of an intrusion | Reported examples | Role described in the advisory | Source and date |
|---|---|---|---|
| Delivery and initial access | Phishing links and malicious attachments; exploitation of CVE-2022-31199 in Netwrix Auditor | Methods described in connection with Truebot activity | CISA, FBI, MS-ISAC and Canadian Centre for Cyber Security, Truebot advisory, July 6, 2023 |
| Discovery and access | Angry IP Scanner; exposed Remote Desktop Protocol (RDP); brute-force tools | Described in the context of Phobos actors finding and accessing exposed RDP services | CISA, FBI and MS-ISAC, Phobos advisory, 2024 |
| Malware and additional capabilities | SmokeLoader, Cobalt Strike and BloodHound | Associated with Phobos activity; the advisory describes actors using additional software after access | CISA, FBI and MS-ISAC, Phobos advisory, 2024 |
| Information collection and theft | Truebot | Described as a botnet used to collect and exfiltrate information, with the ability to download additional modules | CISA, FBI, MS-ISAC and Canadian Centre for Cyber Security, Truebot advisory, July 6, 2023 |
| Movement between systems | RDP and PsExec | Used for lateral movement in the Royal ransomware advisory | CISA, FBI and MS-ISAC, Royal advisory, 2023 |
| Persistence and remote administration | Remote monitoring and management (RMM) software, including AnyDesk, LogMeIn and Atera | Used for persistence in the Royal advisory | CISA, FBI and MS-ISAC, Royal advisory, 2023 |
| Communications and data movement | Chisel; Cobalt Strike beacons | Chisel was described as a tunneling tool used for communications with command-and-control infrastructure; Truebot reporting described Cobalt Strike beacons used for persistence and exfiltration | CISA, FBI and MS-ISAC, Royal advisory, 2023; CISA, FBI, MS-ISAC and Canadian Centre for Cyber Security, Truebot advisory, July 6, 2023 |
Phishing and exploitation can both provide a way in
Phishing can lure someone into following a link or opening an attachment. But it is not the only route described in the cited advisories: the Truebot advisory also documented exploitation of a software vulnerability. The same advisory reported increased use of new Truebot variants as recently as May 31, 2023. That observation describes the reporting period; it should not be read as a statement about prevalence in 2026.
The Phobos advisory described phishing, exposed RDP and IP-scanning tools in its account of reconnaissance and access. It also described brute-force activity after exposed RDP services were found. These are incident examples, not instructions for scanning networks or attempting access.
Malware can carry out different jobs
Malware is software used to perform harmful actions, but that broad label covers different capabilities. In the Phobos advisory, CISA and its partners associated activity with SmokeLoader, Cobalt Strike and BloodHound; the advisory described SmokeLoader as a backdoor Trojan used in conjunction with Phobos. The Truebot advisory, by contrast, described a botnet that could collect and exfiltrate information and download additional modules. These examples show why it is more useful to ask what a capability did in a particular incident than to treat every malware name as interchangeable.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteAre hacker tools always malicious?
No. Some attackers use purpose-built malware, while others also abuse legitimate remote-access, remote monitoring and management, or system-administration software. Those products have legitimate uses, including administering systems. Their presence on a device is not, by itself, evidence that it has been compromised.
Rank #3
A joint CISA, NSA, FBI and MS-ISAC guide explains that threat actors can use remote-access software for several purposes, including initial access, persistence, deploying additional software, lateral movement and exfiltration. The Royal ransomware advisory gives specific examples: RDP and PsExec were associated with lateral movement, while RMM software was used for persistence. Those observations describe how the software appeared in that incident, not what ordinary use of the software means.
For an organization, the relevant question is whether the software’s use fits an approved business purpose and expected pattern. An unfamiliar installation, an unexpected account or access at an unusual time may warrant investigation, but no single indicator settles the question. Consider the source of the alert, the account and device involved, and related network or endpoint activity.
How should defenders interpret these examples?
Focus on behavior and relationships between events rather than treating a software name as a verdict. A legitimate administration tool can be abused; conversely, finding it on a device does not establish malicious activity. MITRE ATT&CK can help teams describe an observed objective and technique consistently, then assess whether their monitoring covers relevant behaviors.
- Check context: Is the remote-access or administration software authorized, expected on that system, and being used by an account with a legitimate need?
- Look for linked activity: Review surrounding sign-ins, endpoint alerts and network activity rather than judging a single tool or alert in isolation.
- Separate evidence from inference: An advisory’s report that a tool appeared in one campaign does not show that every installation or use is hostile.
- Use ATT&CK as a framework: It can organize threat information and support detection and coverage analysis, but it does not identify a universally best security product.
What practical steps reduce risk?
The government advisories recommend layered measures. They can reduce exposure and improve response, but none guarantees that an organization will prevent every intrusion.
Best Value
- Manage remote access carefully. Review which remote-access software is permitted, where it is installed and who can use it. CISA, NSA, FBI and MS-ISAC’s Guide to Securing Remote Access Software addresses the risks of remote-access tools being repurposed by threat actors.
- Patch vulnerable software. The Truebot advisory recommends patching, including attention to vulnerable software implicated in its reporting.
- Monitor network activity. Look for activity that does not fit expected use and investigate it alongside endpoint and account information.
- Use antivirus protection. This is among the mitigations recommended in the Truebot advisory, as one layer rather than a complete defense.
- Protect backups. The Truebot advisory recommends ensuring backup data is encrypted and immutable, helping reduce the risk that attackers can alter or destroy recovery copies.
Is there a definitive list of the most-used hacker tools?
The cited advisories do not establish a current global ranking or a cross-tool prevalence statistic. They document particular incidents and campaigns, at particular times and in particular contexts. Treating those examples as “the most-used” tools—or turning incident-specific access figures into a universal estimate—would go beyond what the sources establish.
For the same reason, a tool list is not a reliable standalone guide to risk. A more useful account connects each example to its reported role, keeps legitimate and malicious use distinct, and gives dates and sources so readers can see the limits of the evidence.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
