Lateral movement in plain English
A burglar climbs into an office building through a basement window and ends up in a storage room – there’s nothing valuable there. But if they find a set of keys, they can work their way through door after door until they’re standing in front of the safe in the executive office. That’s exactly what lateral movement is in IT.
For attackers, the first compromised computer – such as an employee’s laptop after a phishing email – is rarely the actual target. It’s just the way in. From there, they look for credentials, connections, and vulnerabilities that will get them further. With each step, their access grows until they reach the systems they’re after: file servers, backups, accounting, or the central user management system.
This often goes on for days or weeks without anyone noticing. That’s because attackers frequently use the same tools that IT administrators work with every day.
How lateral movement works
- Looking around: The attacker explores the network. Which computers and servers are there, which shares are accessible, and who is logged in where?
- Collecting credentials: They search for stored passwords and extract password hashes from memory. A hash is a kind of mathematical fingerprint of a password.
- Moving on: With their loot, they log in to other systems – via remote administration features, file shares, or management tools that come built into Windows anyway. With pass-the-hash, they don’t even need the actual password.
- Escalating privileges: On each new system, they look for ways to gain higher privileges (privilege escalation) until they have administrator rights for the entire network.
- Reaching the goal: The end result is data theft, sabotage, or the encryption of all systems by ransomware.
MITRE ATT&CK, the public knowledge base that describes how real-world attackers operate, lists lateral movement as a tactic in its own right – that is, a distinct phase of an attack – with numerous techniques.
A practical example
Here’s a typical scenario: A tax advisory firm with two offices receives a rigged job application by email. An employee opens the attachment, and malware starts running unnoticed on her computer. The attacker discovers that the same local administrator password is set on every workstation. Using the extracted hash, they log in to one computer after another. On one of them, the IT service provider had recently logged in with a domain administrator account – and its credentials are still in memory. This gives the attacker access to the server holding client data and to the backups. Network segmentation and separate administrator accounts would have cut off this path at several points.
Why does this matter for businesses?
Even a well-protected company can’t always prevent the initial break-in – a single convincing phishing email is enough. What matters, then, is how far an attacker can get afterward. If they can move around freely, one infected laptop quickly turns into a company-wide outage.
At the same time, lateral movement is a phase in which attackers can be spotted. They log in to unfamiliar computers, use accounts at unusual times, and access systems that these accounts never otherwise use. If you recognize such patterns, you can stop an attack before major damage is done.
How to protect your organization
- Segment your network: Separate workstations, servers, administration, and production from one another. As a rule, workstations don’t need to communicate with each other directly.
- Make local administrator passwords unique: Tools such as Windows LAPS give each computer its own password, which changes regularly.
- Separate administrator accounts: Use dedicated accounts for administration and a tiered model that strictly separates accounts for workstations, servers, and central systems.
- Require a second factor: Protect remote access and administrative access with multi-factor authentication, i.e., an additional confirmation – via an app, for example.
- Detect movement: Endpoint detection solutions (EDR) and central analysis of sign-in logs make unusual access visible.
- Prepare your response: Define who makes the call and who isolates affected systems when something looks suspicious.
How Rootsektor can help
A realistic attack simulation shows how far an attacker would get in your network. As part of Red Teaming & APT Simulation, we move through your environment in a controlled way while checking whether your detection is triggered and your team responds. As a variant of or complement to red teaming, we offer purple teaming: we play through the techniques step by step together with your defense team. For a focused look at your internal network, a network and infrastructure penetration test is a good fit.