Lateral movement

The techniques attackers use after gaining an initial foothold to move from one compromised system to others within a network, seeking higher privileges and valuable data.

An attacker rarely lands on exactly the system they want. More often, they start with one employee's computer or account and then explore. Lateral movement can involve stealing more passwords, using remote administration tools, exploiting unpatched internal systems, or abusing shared administrator credentials that work on many machines.

This stage is often what turns a single infected laptop into a business-wide ransomware incident. In small business networks, it is common for every computer to be able to reach every other computer, and for the same local administrator password to be used everywhere, which makes moving around easy. The time attackers spend moving laterally is also an opportunity to detect and stop them before serious damage occurs.

Practical tip: make lateral movement harder by using unique local administrator passwords on every computer (Microsoft's LAPS tool can manage this), segmenting your network, limiting administrator accounts and making sure endpoint detection alerts are monitored. Separate admin accounts from everyday user accounts used for email and browsing.