Lateral movement
The phase of a cyberattack in which the attacker moves from system to system after initial compromise, seeking higher-value targets.
In June 2017, NotPetya got in through a poisoned update of M.E.Doc, a Ukrainian accounting package. The damage was done inside the networks: on each machine the code pulled credentials from memory with a Mimikatz-derived tool, then spread through PsExec, WMI and the EternalBlue exploit to every host it could reach. That is lateral movement, tactic TA0008 in MITRE ATT&CK: the phase in which an attacker who already has a foothold moves from system to system using valid credentials, internal vulnerabilities or trust relationships between machines. The goal is to escalate privileges, reach data servers or Active Directory domain controllers, and only then trigger the final action, whether encryption, exfiltration or sabotage. Pass-the-hash (T1550.002) reuses a password hash without knowing the cleartext; remote services such as RDP or SMB (T1021) provide the routes. Kerberoasting (T1558.003) is strictly a credential-access technique: it pulls Kerberos tickets for service accounts and cracks them offline, and those accounts are then used to move. The longer and wider the lateral movement, the more systems are hit and the bigger the remediation bill. In cyber underwriting, network segmentation, least privilege, privileged-account protection and EDR that watches credential use are the controls that cap the scope of the loss.
During a ransomware attack on an industrial group, the attacker first compromises a sales employee's workstation via a phishing email, then spends 11 days moving laterally to reach domain controllers and deploy encryption across the entire infrastructure, multiplying remediation costs tenfold compared with an attack confined to the initial endpoint.
lateral movement, network propagation, pivoting, lateral movement definition
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.