Lateral Movement

Lateral movement is the set of techniques attackers use to expand from their initial foothold — one phished employee, one infected laptop — to the assets they actually came for: domain controllers, finance systems, source code, customer databases. Almost no intrusion starts where it intends to end. The first victim of a phishing email is rarely the target; they are the doorway, and lateral movement is the walk down the corridor.

How it works

Once inside, attackers loot the first machine for anything that opens a second one: cached passwords, browser-saved logins, session tokens, SSH keys, and shared-drive documents that mention other systems. They then reuse those credentials against internal services — RDP, SMB, VPN portals, cloud consoles — often using the same legitimate tools administrators use, so the traffic looks routine. Each new system yields more credentials, and each hop is chosen to escalate privilege or approach the objective. This is why a phished intern account can end in a domain-wide ransomware event: the intern's permissions were never the point, only the starting position. Excess permissions accumulated through privilege creep shorten the journey dramatically, because a single compromised account already opens far more doors than the attacker expected to need. The whole phase happens inside the dwell-time window, typically coordinated through a command-and-control channel.

How to defend against it

Assume the first compromise will happen and design the interior accordingly. Least privilege and regular access reviews shrink what any single stolen account can reach; network segmentation and zero-trust architecture turn one flat corridor into a series of locked doors; MFA on internal and administrative access — not just at the perimeter — makes replayed passwords useless. Monitor for the movement itself: first-time logins between systems, unusual admin-tool use, and service accounts behaving like humans. And shorten the runway at its start: an employee who reports the phish in the first minutes forces the attacker off the network before the second hop — one more reason detection speed, not prevention alone, decides how these incidents end, as our incident response guide details.