Phase of a cyberattack in which the attacker moves from system to system after initial compromise, seeking higher-value targets.
Lateral movement refers to the phase of an attack in which an attacker, having obtained initial access to a network, progresses toward other systems and resources by exploiting valid credentials, internal vulnerabilities or trust relationships between machines. The objective is to elevate privileges, reach servers containing sensitive data or Active Directory domain controllers, and widen the footprint of the compromise before triggering the final action, whether encryption, exfiltration or sabotage. Among the most common lateral-movement techniques are pass-the-hash, which reuses password hashes without knowing the cleartext, and kerberoasting, which exploits the Kerberos authentication protocol to extract and crack service-account passwords. The duration of lateral movement is directly linked to the extent of the cyber loss: the longer and wider it is, the more costly the remediation and the greater the number of affected systems. For cyber underwriting, network segmentation, credential-movement monitoring via Endpoint Detection and Response, and least-privilege policies are controls directly correlated with limiting the scope of the loss.
During a ransomware attack on an industrial group, the attacker first compromises a sales employee's workstation via a phishing email, then spends 11 days making lateral moves to reach domain controllers and deploy encryption across the entire infrastructure, multiplying remediation costs tenfold compared with an attack confined to the initial endpoint.
lateral movement, déplacement latéral, propagation dans le réseau