Lateral movement: what it is and how it happens

When an attacker manages to get into a network (through a phishing email, a leaked password, an unpatched flaw, or any other means), that first device or system is almost never what they’re after. It’s just the entry point. From there, lateral movement begins: the process by which the attacker moves from one machine to another within the network until reaching what they’re actually after. And that final target can vary widely depending on the attack: central servers or databases, yes, but also the organization’s administrative accounts, industrial control systems (SCADA/OT), or simply any machine from which to launch a ransomware’s mass encryption.

Understanding this phase properly — not as a vague notion of “the attacker moves around inside,” but as a sequence of concrete steps — is what makes the difference between reacting once it’s too late and having a network designed to stop it from the start. This article explains, in plain terms, how lateral movement works, with real examples and the measures that best stop it.

What lateral movement is and when it appears in an attack

The international reference framework MITRE ATT&CK lists lateral movement as one of its main tactics (identified as TA0008) and defines it as the set of techniques an attacker uses to enter and take control of other computers within the same network, since reaching the final target usually requires exploring the network and hopping from one system to another until getting there.

To reach this point, the attacker has already gone through several earlier phases: gaining entry, executing some program, making sure not to lose that access, and gathering credentials (usernames and passwords) that allow them to authenticate on the next machines they want to reach.

A striking fact: although it’s one of the phases that ends up causing the most damage, it’s also one of the phases with the fewest distinct techniques in the MITRE ATT&CK catalogue — which is misleading, because that small size doesn’t reflect its real weight in how an attack ultimately plays out. From the SolarWinds case to the most common ransomware, practically every serious cyberattack depends on this phase to go from any ordinary computer to the systems that actually matter.

And this is where it’s worth not oversimplifying: not every attacker is after the same thing once inside. Some go straight for stealing information (intellectual property, customer data, classified information); others install themselves silently for months to spy without being detected; others deploy ransomware across as many machines as possible to maximize the pressure of a data hostage situation; and in sectors like energy, water, industry, or defense, the goal may be to reach the physical process control systems — what’s known as OT or SCADA environments — in order to manipulate or disrupt a plant or a piece of critical infrastructure. Lateral movement is the same mechanism in every case; what changes is where it leads.

Two examples help put this in perspective. WannaCry, in 2017, spread across thousands of networks within hours by exploiting a flaw in an internal network protocol, without needing a single additional click from the victim. NotPetya, that same year, combined credential theft with legitimate remote administration tools to hop from one computer to another across entire corporate networks, and ended up paralyzing the operations of logistics and industrial multinationals for days. In both cases, what caused the massive damage wasn’t the initial access, but how quickly the attack moved once inside.

How lateral movement happens, step by step

1. The attacker explores the network from the inside

As soon as they’re in, the attacker needs to get their bearings: what computers exist, how they relate to each other, where the most important systems are, and which users have the most permissions. To do this, they typically use the same tools any systems administrator would use, precisely so as to go unnoticed among the company’s normal activity.

2. They obtain passwords and credentials from other users

With the terrain already mapped, the next step is to get hold of credentials that open other doors: stealing passwords stored in the computer’s memory, reusing an “encrypted” password without decrypting it to impersonate another user, or even forging an internal identity-system access “pass” to authenticate as a highly privileged user, without knowing any real password.

3. They pose as a legitimate user to jump to other machines

This is the core of lateral movement. Instead of installing a virus that could be easily detected, the attacker connects to other machines using stolen but valid credentials, through tools that already exist in any company and that technicians themselves use every day:

• Remote Desktop (RDP) — Very common in ransomware attacks to jump from one server to another once inside, as the operators behind the Conti ransomware did.
• Network shared folders (SMB) — Used to copy malicious programs from one computer to another, as the TrickBot virus did to spread.
• SSH and other remote administration tools — Just as common, and just as exploitable once the attacker already has a valid password.
• Remote command execution and scheduled tasks — Allow a program to be launched on another computer without needing to sit down in front of it, something any IT team uses daily for maintenance.

This is exactly what makes this phase so hard to detect: the attacker connects with credentials that are stolen but real, so on the surface their activity looks a great deal like a technician doing their job. Detecting it requires watching internal traffic patterns, unusual connections, and suspicious logins — not just what’s trying to get in from outside.

4. They repeat the process until reaching the target

Once inside the next machine, the attacker typically copies more tools and starts over: explore, obtain passwords, jump. They repeat this cycle as many times as needed. In many well-documented ransomware attacks, the order is always similar: reconnaissance, initial access, infrastructure exploration, lateral movement, further privileges, and finally the final attack — for example, encrypting all files or, in industrial environments, disrupting a physical process.

A concept that helps put the urgency in perspective is “breakout time”: the interval between the attacker’s initial access and their first lateral jump. In many current intrusions this is measured in minutes, not hours, leaving little room to spare if detection relies solely on manual review.

Why it’s so hard to detect

What all these techniques have in common is that they use legitimate tools that already exist in any company. There’s almost never a file with a virus that antivirus software can recognize: there’s a remote desktop connection, access to a shared folder, or an administration command that, on paper, looks like any routine maintenance task. Truly detecting it requires cross-referencing information across several points — computers, the network, and logins — rather than looking at just one of those sources, precisely because these techniques are designed to blend in with the systems team’s everyday work.

How to reduce the risk

Reference bodies such as Spain’s Centro Criptológico Nacional, through its CCN-STIC guides, place control of lateral movement as a central goal when designing secure networks, and consider detecting this kind of behavior one of the key functions any monitoring system within an organization should cover.

In practice, what reduces the risk the most is:

• Segmenting the network, so that one infected computer doesn’t have a clear path to the rest. In industrial environments, this also means strictly separating the office network (IT) from the plant network (OT) — something several serious critical infrastructure incidents have shown still isn’t done properly in many cases.
• Giving each user only the permissions they need, not one more.
• Requiring two-factor authentication on administrative access, so a stolen password alone isn’t enough.
• Managing privileged access centrally (PAM), preventing administrator passwords from being exposed on users’ own computers.
• Continuously monitoring what happens inside the network, not just what’s trying to get in from outside.
• Never assuming a user is trustworthy just because they’re already inside the network (the principle behind so-called “Zero Trust”), verifying every access, wherever it comes from.

This last set of measures is precisely where shielded remote work environments like Endurance, from Cosmikal, add an extra layer of protection: by integrating privileged access management (PAM), virtual desktops (VDI), and identity management (IAM) into a single platform, administrator passwords never end up exposed on the user’s workstation, and every session is isolated and logged. This greatly reduces the room an attacker would have to jump from one computer to another after an initial security failure, both in office environments and in remote access to sensitive industrial systems.

Sources

• MITRE ATT&CK®, Lateral Movement, Tactic TA0008 — attack.mitre.org/tactics/TA0008
• CCN-CERT, BP/01 Principios y recomendaciones básicas en ciberseguridad, Centro Criptológico Nacional
• CCN-CERT, XIV Jornadas STIC — Movimientos laterales en Ransomware, Centro Criptológico Nacional
• SenseOn, MITRE ATT&CK Lateral Movement: Detection and Response
• StartupDefense, Lateral Movement (TA0008)