What Is Lateral Movement? How Cyberattacks Spread Inside Your Network
In cybersecurity, lateral movement is the set of techniques cybercriminals use after initial access to move from one compromised system to others, using stolen credentials and built-in admin tools. In ransomware intrusions, it carries attackers from a single foothold to Active Directory, backups, and sensitive data before encryption begins.
Lateral movement determines how far ransomware spreads across a company network. Once cyberattackers are inside, they need only 29 minutes on average to start moving toward other systems, and the fastest observed breakout took 27 seconds.
How lateral movement works, from first foothold to domain-wide control
Lateral movement is a tactic, not a single technique. The standard industry definition covers every method an adversary uses to enter and control remote systems on a network. Ransomware operators repeat the same loop until they control the most critical systems: map the network, steal a working login, move to the next system, and escalate. Every hop looks like a normal login, which is why the loop is hard to see.
Step 1: map the network from the first foothold
After the foothold, attackers map the environment. They check which hosts exist, who holds admin rights, and where the domain controllers and backup servers sit. Much of this relies on built-in tools and queries, which blend in with routine administration.
Step 2: steal logins that work
Next, threat actors harvest credentials from memory, browsers, and configuration files. Credentials fuel lateral movement because a valid login looks like normal activity. Stale access makes this easier.
Magdy Abdelaziz, Head of DFIR at Proven Data, notes that old employee logins, vendor VPN accounts, unused domain admins, and forgotten service accounts are often the easiest route.
Step 3: move with legitimate access
With a working login, the intruder connects to the next system. The hop itself is lateral movement: using valid credentials, remote services, and built-in admin tools to reach another host.
Typical routes are Remote Desktop, SMB admin shares, WMI, and PowerShell remoting, which the techniques section below breaks down. Each new host gives them another place to look for credentials.
Step 4: escalate and repeat until the attacker controls the domain
Each hop gives them a chance to collect stronger credentials until they hold domain-level control. Privilege escalation is gaining higher permissions than the compromised account originally had. From there, they stage data for theft, disable security tools, and go after backup consoles.
How lateral movement differs from initial access, privilege escalation, and persistence
These four stages overlap inside a single intrusion, so they are easy to confuse. The table orders them by when each appears in an intrusion.
| Stage | What it means | Typical example |
|---|---|---|
| Initial access | The first way into the network | Exposed VPN, phished session, purchased credentials |
| Lateral movement | Moving from one compromised system to others with valid access | RDP, SMB admin shares, WMI, or PowerShell remoting with valid accounts |
| Privilege escalation | Gaining higher permissions than the compromised account had | Reusing a stolen admin credential |
| Persistence | Keeping access after password resets, reboots, or cleanup | A weekly scheduled task that re-downloads a beacon |
In practice, the stages loop. Initial access happens once, but lateral movement and privilege escalation repeat on each new host because each move often yields new credentials. Persistence runs alongside them, and incident response teams often overlook it during recovery, which is why it shapes the recovery section below.
How to detect lateral movement
Detection is hard because threat actors use the same tools your administrators use. Living off the land means using legitimate, built-in operating system tools for malicious purposes.
Amr Fathy, Senior Digital Forensics and Incident Response (DFIR) Engineer at Proven Data, says responders most often see WMI and PowerShell used for lateral movement. The commands look identical to routine sysadmin work.
Judge the context, not the command
"We differentiate by context: what account, what time, what source, what child processes," says Fathy. His example of a red flag is a WMI process spawning certutil.
Alert fatigue works against defenders here. Encoded PowerShell fires constantly in legitimate use, so analysts close those alerts out of habit, which is exactly why intruders favor it for command and control. Fathy's fix is not fewer alerts but better correlation with surrounding activity.
Read the authentication logs
Windows authentication events show the hops. Event 4624 records successful logons; logon type 10 marks remote interactive sessions (such as RDP), and type 3 marks network logons. Event 4648 records logons with explicit credentials, and event 4769 records Kerberos service ticket requests.
Together, these events reveal patterns: one account authenticating to many hosts within minutes, or an admin account logging on from a workstation it has never used.
Treat it as deployment in progress when disabled security tools, deleted shadow copies, backup console access, and payloads on admin shares cluster within minutes.
Know where evidence lives when endpoint detection goes blind
Endpoint detection and response (EDR) is the first place teams look, and attackers know it. Some operators load a vulnerable signed driver to terminate the sensor before encryption. Abdelaziz explains that scoping confidence drops in that case but does not collapse.
Firewall, proxy, DNS, and NetFlow records still tell the story, as do cloud audit and sign-in logs and host artifacts such as the MFT and USN journal. For earlier warning signs, see our guide on detecting ransomware attacks.
How lateral movement determines the scope of a ransomware incident
The initial foothold usually doesn’t determine the size of the loss. What intruders reach afterward does, which is why incident response starts by scoping how far they got.
Abdelaziz clearly separates the two models: automated ransomware is noisy and opportunistic, while human-operated ransomware adapts to what it finds.
The forensic tells of the human-operated model include hands-on keyboard commands, staged tools, targeted lateral movement, and backup console access.
Timing matters too. In many cases, the ransomware operator isn't the original intruder, and first access can predate detonation by weeks or months, though same-day handoffs also happen.
Lateral movement also feeds extortion. Ransomware operators reach the same file servers they copy data from, which is how double-extortion ransomware gets its leverage.
For MSPs, the exposure multiplies: our LockBit 3.0 analysis notes that one compromised remote monitoring and management (RMM) deployment can propagate a payload across an entire managed client base within hours.
Common lateral movement techniques in ransomware intrusions
Ransomware operators favor techniques that reuse legitimate access. The table maps the techniques operators rely on to their ATT&CK IDs and to the evidence each leaves behind.
| Technique | What it abuses | Where the evidence appears | ATT&CK ID |
|---|---|---|---|
| Remote Desktop Protocol | Valid accounts over RDP | Logon type 10 events, RDP connection logs | T1021.001 |
| SMB admin shares and PsExec | Admin credentials over SMB | New services, files written to admin shares | T1021.002 |
| PowerShell remoting (WinRM) | Built-in remote management | PowerShell logs, remote session events | T1021.006 |
| WMI | Built-in management tooling | Process creation logs, unusual child processes | T1047 |
| Pass the hash | Stolen password hashes | Network logons from unexpected sources | T1550.002 |
| Pass the ticket | Stolen Kerberos tickets | Anomalous ticket requests such as event 4769 | T1550.003 |
| Group Policy modification | Domain-wide policy push | Group Policy Object (GPO) changes outside change windows | T1484.001 |
SMB with PsExec is a common route. In LockBit 3.0 intrusions, lateral movement primarily runs over SMB through PsExec, and Group Policy modifications can push the payload domain-wide. That compresses the encryption window from hours to minutes.
Identity-store persistence is quieter still. Fathy points to editing the AdminSDHolder ACL, which pushes a backdoor entry to every admin group every 60 minutes, even after password resets. He also cites adding a rogue SPN to an ordinary user account. In cloud environments, threat actors add certificates to existing app registrations, and those survive resets too.
Why lateral movement through Active Directory makes recovery take weeks
Recovery time rarely depends on how much data was encrypted. According to Abdelaziz, it depends on whether you can still trust Active Directory and the backup infrastructure. Once attackers have moved through them, every restore waits on proof that the environment is clean.
Persistence turns a rushed restore into a second incident. Fathy has seen clients recover successfully and get re-compromised within 48 hours from a poisoned GPO inside a restored AD backup. Audit restored Active Directory for malicious GPOs and logon scripts before it goes back online.
Backups carry the same risk. Even with immutable storage, threat actors can still compromise backup admin credentials, change retention, delete catalogs, disable jobs, or destroy encryption keys.
Professional ransomware recovery therefore starts with identity and the backup control plane, not with servers. For realistic timelines, see how long it takes to recover from ransomware.
Controls that shrink the blast radius before an incident
Controls that limit lateral movement are mostly identity hygiene. They reflect the gaps Proven Data's DFIR team finds in post-incident audits.
Review privileged access daily
Abdelaziz's one change for every SOC is a single review queue. It covers new admins, stale admins, failed multifactor authentication (MFA), suspicious OAuth grants, new RMM tools, backup console access, edge device logins, and service account anomalies.
Disable stale privileged accounts
Accounts that belong to former employees, vendors, or retired services give intruders an easy path. Disabling them removes a route that cybercriminals already know to look for.
Enforce MFA in the system, not as an option
You must confirm that MFA covers admin portals, not just email.
The phrase Abdelaziz hears most after incidents is "We thought MFA was everywhere." Fathy adds that the system must enforce MFA, not just offer it.
Treat edge devices like critical servers
Firewalls, VPN appliances, and remote access gateways are primary initial access targets with weaker telemetry than endpoints. Patch them quickly, log them deeply, and monitor them continuously, as you would any critical server.
Watch non-human identities
API keys, OAuth tokens, service accounts, and RMM agents are the next target. Identity threat detection and response monitors identity activity for abuse of these accounts.
Pair network segmentation with scoped admin accounts
Segmentation limits where a stolen credential can reach, but only when the account is also restricted to the systems it needs. Without scoped admin accounts, a single domain admin login crosses every boundary.
How to respond to active lateral movement
Speed matters, but so does restraint. Don't reimage systems before you capture evidence, because that destroys the telemetry needed to prove eradication. Cut connectivity instead of power, and copy this first-hour checklist into your runbook:
- Sever network connectivity at switch ports, VLANs, or the VPN concentrator. Our guide explains how to isolate ransomware-infected servers.
- Isolate domain controllers and backup repositories first.
- Switch to an out-of-band channel. Assume email and chat are compromised.
- Preserve evidence before rebuilding. Follow the steps to preserve ransomware evidence.
- Unlink any malicious GPO and disable compromised privileged accounts.
- Call a response team before restoring anything.
Proven Data's 24/7 incident response team has handled over 3,000 incidents since 2011.
Written by
Cybersecurity writer at Proven Data covering ransomware trends, incident response, and data protection best practices.
Written by
Magdy Abdelaziz is a dedicated cybersecurity professional with over 7 years of extensive experience in digital forensics, incident response, reverse engineering, and security operations. He currently serves as Head of Digital Forensics and Incident Response (DFIR) at Proven Data LLC, leading a multinational team to develop and execute incident response strategies, align security initiatives with business objectives, and manage global-scale incidents.
Written by
Amr Fathy is a dedicated cybersecurity professional with over 7 years of extensive experience in digital forensics, incident response, reverse engineering, and threat intelligence. He currently serves as Senior DFIR Engineer at Proven Data LLC, conducting triage collection, incident response, and digital forensics activities.
Reviewed by
Content strategist at Proven Data focused on cybersecurity education, threat analysis, and ransomware awareness.
