Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Hackers do not rely on one fixed “arsenal.” An intrusion can combine phishing or software exploitation, malware, stolen credentials, remote-access tools and methods for moving through a network or taking data. Some capabilities are purpose-built for abuse; others are legitimate system or administration tools that attackers misuse. A tool’s presence alone does not prove an intrusion.
What does “hacker tools” mean?
The phrase can refer to very different things: malware, software used to gain or maintain access, utilities that help attackers move through a network, or legitimate tools repurposed for malicious activity. The word “weapon” is a metaphor, not a description of a single standard kit.
It also helps to separate an attacker’s objective from the method and software involved. MITRE ATT&CK organizes observed adversary behavior around tactics—the reason for an action—and techniques—how the action is carried out. A tool is one possible implementation detail. MITRE’s ATT&CK knowledge base gives defenders a shared way to organize behaviors, consider detections and assess defensive coverage; it is not a ranking of products or proof that any one product is universally best.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhich tool categories can appear during an intrusion?
The examples below come from specific CISA-led advisories, not a complete catalogue. They illustrate reported roles in particular campaigns and should not be read as a ranking of the most-used tools.
#1 Best Overall
| Category | What it can do in an intrusion | Reported example and context |
|---|---|---|
| Phishing and delivery | Trick a person into opening a link or attachment that leads to malicious activity. | CISA’s July 2023 Truebot advisory described phishing links and malicious attachments as delivery methods. |
| Exploitation and access attempts | Take advantage of vulnerable software or exposed remote services to seek access. | CISA’s July 2023 Truebot advisory documented exploitation of CVE-2022-31199 in Netwrix Auditor. CISA’s 2024 Phobos advisory described exposed RDP and brute-force tools in its incident context. |
| Malware and payloads | Establish a foothold, collect information, or download additional components. | CISA’s 2024 Phobos advisory associated Phobos activity with SmokeLoader, Cobalt Strike and BloodHound. CISA’s 2023 Truebot advisory described Truebot as a botnet used to collect and exfiltrate information and noted that it could download additional modules. |
| Remote administration and system utilities | Provide remote access, support persistence, or help move between systems. | CISA’s 2023 Royal ransomware advisory reported RDP and PsExec use for lateral movement and RMM software such as AnyDesk, LogMeIn and Atera for persistence. |
| Tunneling and command-and-control communications | Help an attacker communicate with infrastructure or maintain a channel into a compromised environment. | The 2023 Royal advisory described Chisel, a tunneling tool, in communications with command-and-control infrastructure. The 2023 Truebot advisory described Cobalt Strike beacons used for persistence and exfiltration in reported incidents. |
| Reconnaissance | Help identify systems or services that may be exposed. | CISA’s 2024 Phobos advisory mentioned IP-scanning tools such as Angry IP Scanner in its reconnaissance and access context. |
These examples describe what advisories reported in particular incidents. They do not establish how often each tool is used across all attackers, or whether a given tool is malicious in every setting.
Are hacker tools always malicious?
No. Some tools are created as malware or for other clearly harmful purposes, but many remote-access and system-management capabilities have legitimate administrative uses. An organization may use remote monitoring and management (RMM) software to support its own computers. CISA, NSA, FBI and MS-ISAC’s 2023 Guide to Securing Remote Access Software explains that threat actors have abused remote-access software for functions including initial access, persistence, deployment of additional software, lateral movement and exfiltration. The guide also notes its use in ransomware incidents and some advanced persistent threat campaigns.
That dual-use nature makes context essential. An unfamiliar remote-access program deserves investigation, but its installation alone is not proof of compromise. Defenders need to consider whether its presence is authorized, which account and system are involved, whether the activity matches expected work, and what other signs appear alongside it. The Royal advisory’s reported use of RDP, PsExec and RMM software is an incident example, not evidence that ordinary use of those tools is inherently malicious.
How do the stages fit together?
An intrusion may involve several techniques and capabilities in sequence, although not every incident follows the same path. A phishing message or exploited vulnerability might provide an initial foothold; malware or a remote-access capability could help preserve access; credentials or system utilities could enable movement to other machines; and communications or data-transfer methods could support collection and exfiltration.
Rank #3
For example, CISA’s 2023 Truebot advisory described phishing and exploitation as delivery or access paths, and described Truebot’s ability to collect and exfiltrate information and download additional modules. CISA’s 2024 Phobos advisory associated that activity with other software, including SmokeLoader, Cobalt Strike and BloodHound. These examples show why a list of standalone tool names can be misleading: the role a capability plays in the broader activity matters more than its name alone.
What can defenders do with this information?
Focus on reducing opportunities for misuse and recognizing behavior in context, rather than treating a particular product name as a verdict. The reviewed advisories recommend layered measures, not guarantees of prevention.
- Manage remote access deliberately. Know which remote-access and RMM software is authorized, who can use it, and which systems it can reach. Review unexpected installations or activity against that baseline.
- Patch vulnerable software. The Truebot advisory specifically recommended patching vulnerable software, reflecting the risk illustrated by its report of CVE-2022-31199 exploitation.
- Monitor network activity. Look for activity that does not fit an account’s or system’s expected role, and consider connections and behavior alongside tool names.
- Use antivirus and other appropriate security controls. CISA’s Truebot advisory included antivirus among its recommended mitigations.
- Protect backups. The Truebot advisory recommended encrypted, immutable backup data. Backups can support recovery, but they do not by themselves prevent an intrusion.
- Organize detection around behavior. ATT&CK can help teams describe the objective and technique behind an observed action and identify where detection coverage may be missing. It does not certify a product or guarantee that a threat will be stopped.
What these examples cannot tell you
The cited advisories are incident-specific snapshots: Royal ransomware reporting from 2023, Truebot reporting released July 6, 2023, and Phobos reporting from 2024. The Truebot advisory noted increased use of new variants observed as recently as May 31, 2023; that dated observation is not a statement about prevalence in 2026.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
These sources do not establish a current global ranking, prevalence statistic or definitive list of tools used by hackers. Nor should incident-specific percentages, where reported, be generalized into a universal estimate of how attackers gain access. The useful takeaway is the pattern: adversaries may combine different techniques and capabilities, and defenders should evaluate what those capabilities are doing in their environment.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
