Lateral Movement

Anyone who breaks into a corporate network almost never lands directly at the interesting spot. The first compromised machine usually belongs to an employee in accounting or sales. There are no customer databases and no password lists there. So the attacker works their way from this machine to the next, and from there to the one after that. This exact chain of intermediate steps is called lateral movement. The English word “lateral” means sideways: the movement does not go deeper into a single computer, but rather across the network.

Why a single compromised laptop is not yet damage

For defenders, lateral movement is the decisive phase of an attack. The initial breach can hardly be prevented entirely. A fake email, a weak password, or outdated software is enough. Whether this turns into an incident causing millions in damages is decided afterward. If the attacker gets stuck on one laptop, the damage is manageable.

Almost all major ransomware attacks with encryption software follow this pattern. The perpetrators first spread through the network for days or weeks. In doing so, they particularly search for the central administrative servers that control all user accounts and passwords. Only once they have this control do they encrypt all machines simultaneously. This also deprives the victim of backup copies, increasing the pressure to pay.

That is why security teams measure what is known as breakout time. It describes how long it takes for an attacker to jump from the first machine to the second. For skilled groups, this is often under an hour. Those who only react after days regularly arrive too late.

How attackers pass themselves from computer to computer

The most important raw material for lateral movement is credentials. On a compromised machine, the attacker searches for usernames and passwords that are cached there. He often also finds passwords of administrators who logged onto this device shortly before. With this data, he then logs on to the next machine completely normally. Technically, this looks to the network like a legitimate employee.

Particularly popular are tools that are present on every corporate computer anyway. These include remote administration programs, command lines, and operating system management services. This is also referred to as “living off the land” — that is, living off what is already there. The advantage for the attacker: he does not have to install any suspicious software of his own that a virus scanner might detect.

A common mix-up is worth clarifying. Lateral movement is not the same as privilege escalation. In privilege escalation, an attacker gains more authority on one and the same machine. In lateral movement, he switches devices. In real attacks, both steps constantly alternate: more privileges, next machine, more privileges again.

Network segmentation, zero trust, and reports of weeks spent inside the network

In news reports about cyberattacks, lateral movement can be recognized by typical phrasing. When it is said that the attackers were “undetected in the network for several weeks,” that is exactly what was happening. Sentences such as “the perpetrators obtained administrator rights for the entire domain” also describe the outcome of this phase. In recent years, hospitals, municipal administrations, and large industrial corporations have been affected.

As a countermeasure, vendors primarily sell two ideas. The first is called network segmentation: the network is divided into isolated zones that are only connected via controlled crossings. A machine in accounting is then not allowed to access the production server at all. The second idea is called zero trust. Under this approach, no device is automatically considered trustworthy just because it is already on the internal network. Every access must re-verify itself.

In addition, there are monitoring systems that evaluate login patterns. If an accounting account suddenly accesses twenty different servers at night, that is conspicuous. Today, AI-based detection systems also search for exactly such patterns, because humans can no longer keep track of the volume of data. For you personally, the principle applies on a smaller scale: a single password used for all services is the perfect launchpad for lateral movement.