Most breaches begin on an ordinary device: a laptop that opened a phishing email, an account with a reused password, or an unknown device that joined the office Wi-Fi. What turns that first foothold into a serious incident is what the attacker can reach next. That next step is called lateral movement.
For many organizations, an attacker can reach a lot. Zero Networks' 2026 Lateral Movement Exposure Report, based on activity across 312 enterprise environments, found that 80% of enterprise servers are reachable from anywhere inside the network. The remote access protocols IT teams use every day, such as RDP and SSH, work just as well for an attacker holding stolen credentials.
This guide explains what a lateral movement attack is, how attackers move from one system to the next, the techniques they rely on most, and how real attacks have unfolded. It also covers how to detect lateral movement and the controls that limit how far an attacker can get once they are inside.
What is a lateral movement attack?
A lateral movement attack is the set of techniques an attacker uses after gaining initial access to move from the first compromised device to other systems, accounts, and parts of the network. Attackers typically rely on stolen credentials and legitimate administrative tools as they work toward high-value targets such as domain controllers, file servers, and sensitive data.
MITRE ATT&CK, the widely used knowledge base of attacker behavior, catalogs lateral movement as tactic TA0008 and groups nine techniques under it. Most of them abuse protocols that already run on the network, including RDP, SMB, SSH, and WinRM. Because IT teams use the same protocols every day, lateral movement often looks like routine administrative activity.
Lateral movement is often confused with privilege escalation, and attackers usually combine the two. Lateral movement means reaching new systems. Privilege escalation means gaining higher permissions on a system the attacker already controls. A typical attack alternates between them: the attacker escalates privileges on one host to collect stronger credentials, then uses those credentials to reach the next.
Why attackers rely on lateral movement
The first device an attacker compromises is rarely the one they want. Lateral movement gives them a path from that starting point to everything else:
Reaching high-value systems. A phished laptop in marketing matters because of what it can connect to, such as domain controllers, file servers, finance applications, and backup systems.
Collecting stronger credentials. Each new host can hold cached passwords, hashes, or tickets for other users, including administrators and service accounts.
Building persistence. Footholds on several machines let an attacker stay in the environment even after IT cleans up the first infected device.
Setting up a bigger payoff. Ransomware operators spread to as many systems as possible before encrypting anything, while data theft campaigns quietly collect information over weeks or months.
Blending in. Activity spread across normal admin protocols and valid accounts generates fewer alerts than malware that announces itself.
How far an attacker can move after the first compromise largely decides how serious the incident becomes.
How a lateral movement attack works
Lateral movement follows a recognizable cycle. Each time the attacker reaches a new system, they repeat the middle stages until they get where they want to go.
Stage 1: Initial access
The attack starts with a foothold. Common entry points include a phishing email, a stolen or reused password, an exposed remote access service, or an unauthorized device connected to the network.
At this point, the attacker usually controls one low-value system with limited permissions.
Stage 2: Internal reconnaissance
Next, the attacker maps the environment from the inside. They look for other hosts, file shares, user and admin accounts, and open ports they can reach from the compromised device.
Attackers often do this with tools already built into the operating system, which leaves fewer new files or processes for security tools to flag.
Stage 3: Credential access
To move further, the attacker needs credentials. They collect them from the compromised system's memory, harvest saved or cached passwords, or capture credentials that users type in.
Shared and reused passwords make this stage much easier, because one stolen secret can unlock many systems.
Stage 4: Moving to the next system
With credentials in hand, the attacker authenticates to another host, often over a standard admin protocol. Where credentials fall short, they may exploit an unpatched service on the target instead.
From the network's point of view, this step can look like an ordinary login.
Stage 5: Reaching the objective
Once the attacker reaches a valuable system, they act on their goal. That might mean copying sensitive data, deploying ransomware across many hosts at once, or quietly maintaining access for later.
Attackers frequently clear logs or remove tools along the way to make the investigation harder.
Stages 2 through 4 repeat at every new host, which is why one compromised account can turn into access across an entire environment.
Common lateral movement techniques
MITRE ATT&CK tracks the specific methods attackers use to move between systems. A handful of them show up in most real-world intrusions, and each one is limited by a different set of controls.
Remote services (T1021)
With remote services, the attacker logs in to another host using stolen credentials over a normal admin protocol such as RDP, SMB and Windows admin shares, SSH, or WinRM. Tools like PsExec and PowerShell remoting make this fast, and the traffic looks like everyday IT work.
The opportunity is large. Zero Networks found that 87% of enterprise servers accept inbound RDP or SSH from broad internal sources, and 78% are reachable over SMB or WinRM.
Pass the hash and pass the ticket (T1550)
These techniques let attackers authenticate with stolen authentication material instead of a password. Pass the hash reuses an NTLM password hash, and pass the ticket reuses a Kerberos ticket. Tools such as Mimikatz pull this material straight from a compromised machine's memory.
Legacy authentication keeps these attacks viable. Zero Networks reports that 43.2% of internal authentication still runs on NTLM.
Exploitation of remote services (T1210)
When valid credentials are not available, an attacker can exploit a vulnerability in a service running on another internal host. Internal systems are often patched more slowly than internet-facing ones, which leaves known vulnerabilities open for longer.
Remote service session hijacking (T1563)
In session hijacking, the attacker takes over an existing SSH or RDP session that a legitimate user already opened. Because the session is already authenticated, the attacker inherits that user's access without needing their credentials.
Lateral tool transfer (T1570)
Once the attacker can reach a new host, they copy over the tools they need, such as malware, scripts, or admin utilities. This usually happens over SMB, the same channel used for file sharing.
Internal spearphishing (T1534)
An attacker who controls a legitimate mailbox can phish coworkers from inside the organization. Messages from a real colleague's account are far more convincing than outside email, which makes this an effective way to collect more credentials.
The table below summarizes how each technique works and which controls limit it.
Technique (MITRE ID) | How attackers use it | What limits it |
Remote services (T1021) | Log in to other hosts with stolen credentials over RDP, SMB, SSH, or WinRM | Network segmentation, least-privilege network access, MFA on admin access, admin protocols limited to admin hosts |
Pass the hash and pass the ticket (T1550) | Reuse stolen NTLM hashes or Kerberos tickets without the password | Protecting credentials in memory, reducing NTLM use, limiting where privileged accounts sign in, endpoint detection |
Exploitation of remote services (T1210) | Exploit an unpatched service on another host | Patching, plus segmentation so vulnerable services are not reachable from user devices |
Remote service session hijacking (T1563) | Take over an existing SSH or RDP session | Session timeouts, SSH key management, monitoring of privileged sessions |
Lateral tool transfer (T1570) | Copy malware or tools to the next host, usually over SMB | Endpoint detection, blocking workstation-to-workstation SMB |
Internal spearphishing (T1534) | Phish coworkers from a compromised internal mailbox | Email security, user awareness, phishing-resistant MFA |
One more path deserves attention because it skips the phishing step entirely. If a network accepts any device that knows a shared Wi-Fi password, or any device plugged into an open wired port, an attacker with that password or physical access starts on the internal network with no compromised account at all. Controlling which devices can join the network, and where they land, closes that path.
Lateral movement attack examples
The techniques above show up again and again in well-documented incidents. These three examples show how lateral movement turned a single point of entry into a much larger compromise.
NotPetya (2017)
NotPetya spread inside networks by stealing credentials from memory with a modified version of Mimikatz, then using PsExec and WMI to run itself on other machines, as described in CISA's alert on the malware and Mandiant's analysis. It also used the EternalBlue SMB exploit against unpatched hosts.
Because the credential-based method relied on valid logins, NotPetya could also infect machines that were fully patched against EternalBlue. Shared and reused admin credentials let it move quickly across connected networks.
SolarWinds supply chain compromise (2020)
In the SolarWinds campaign, attackers entered through a trojanized update to SolarWinds Orion software, according to CISA advisory AA20-352A. Once inside, CISA reported that they moved laterally using WMI and remote scheduled tasks.
The attackers also escalated privileges in Active Directory and forged authentication tokens, which let them move from on-premises networks into cloud environments such as Microsoft 365.
Akira ransomware (2023 to present)
CISA advisory AA24-109A describes Akira affiliates gaining initial access through VPNs without MFA, then harvesting credentials with tools such as Mimikatz and LaZagne. Before moving laterally, they commonly disable security software to avoid detection.
The advisory also notes that Akira actors use legitimate remote access tools to persist and blend in, a pattern common to modern ransomware groups.
In each case, the damage scaled with how far the attackers could move and how many credentials they could reuse.
How to detect lateral movement
Lateral movement is hard to spot because it uses valid accounts and normal admin tools, but it still leaves patterns that stand out against everyday activity. Common signs include:
One account authenticating to many hosts in a short window. Regular users typically sign in to a small, predictable set of systems.
Admin protocol traffic between workstations. RDP, SMB, or WinRM connections between two employee laptops rarely have a legitimate reason.
Admin tools running from unexpected machines. PsExec, PowerShell remoting, or remote WMI commands launched from a non-admin endpoint deserve a closer look.
Logins that break the user's normal pattern. Watch for unusual hours, unfamiliar devices, or access to systems outside the user's role.
Spikes in failed authentication. Repeated failures across servers, Wi-Fi, or VPN can signal password guessing or credential testing.
New or unknown devices on the network. A device nobody recognizes on a sensitive segment is worth investigating right away.
These signals come from several sources, so visibility depends on bringing them together. Endpoint detection and response (EDR) tools show process and credential activity on each host. Windows authentication logs show who signed in where. Network monitoring shows which systems are talking to each other. Network authentication logs, such as RADIUS records, show which users and devices joined Wi-Fi, VPN, or wired networks and when.
How to prevent lateral movement
No single control stops every lateral movement technique. The most effective approach combines two goals: limit what an attacker can reach from any one device, and limit the credentials they can steal and reuse.
1. Segment the network by role and trust level
Segmentation divides the network into zones so that users, guests, IoT devices, and servers sit on separate segments with controlled routes between them. A compromised device on a guest or BYOD segment should have no path to finance systems or domain controllers.
Segmentation works best when placement is tied to identity instead of maintained by hand. Our guide to network segmentation covers how to plan and enforce it.
2. Authenticate every device before it joins the network
Use 802.1X on Wi-Fi and wired networks so every user or device proves who it is before getting access. Per-user or per-device credentials replace a shared password that anyone with physical proximity or a leaked password could use.
This closes the path where an attacker simply connects a device to the network and starts moving from there.
3. Replace reusable passwords with certificates where possible
Certificate-based network authentication, such as EAP-TLS, ties access to a certificate installed on a managed device. There is no network password for an attacker to phish, guess, or harvest and replay on another system.
4. Enforce least privilege for accounts
Give admins separate accounts for administrative work, and limit where privileged accounts can sign in. Add MFA to admin access so a stolen password alone cannot unlock high-value systems.
Fewer privileged credentials cached on everyday workstations means less for an attacker to collect in the credential access stage.
5. Restrict admin protocols
Allow RDP, SMB, WinRM, and SSH only from the hosts that need them, such as designated admin workstations. Block workstation-to-workstation traffic on these protocols, which removes many of the paths used for remote services and lateral tool transfer.
6. Patch internal services consistently
Internal systems deserve the same patching attention as internet-facing ones. Combined with segmentation, timely patching keeps vulnerable services out of reach and limits exploitation of remote services.
7. Monitor authentication and respond quickly
Centralize logs from endpoints, servers, and network authentication so suspicious patterns are visible in one place. Pair that visibility with EDR and a tested response plan, so a compromised account or device can be isolated before the attacker moves further.
How Foxpass limits lateral movement at the network edge
Foxpass, from Splashtop, provides cloud-hosted RADIUS, PKI, and LDAP services that control who and what can connect to your network. It helps IT teams put identity checks on every Wi-Fi, VPN, and wired connection, which limits how far an attacker can get from a compromised device.
1. Identity-based network access and segmentation
Foxpass Cloud RADIUS authenticates each user or device before it joins the network, then assigns it to a VLAN based on directory group membership in Google Workspace, Okta, Microsoft Entra ID, OneLogin, or LDAP. A guest or BYOD device lands on a restricted segment, while finance and engineering devices land on their own.
If one of those devices is compromised, the attacker starts on a segment with limited routes to the rest of the network. Learn more about dynamic, identity-based segmentation with Foxpass.
2. Passwordless certificate-based authentication
Foxpass Cloud PKI issues certificates to devices through MDM integrations and SCEP, so managed devices can connect with EAP-TLS. With certificate-based authentication, there is no shared Wi-Fi password to steal and reuse.
For teams that are not ready to move every device to certificates, Foxpass also supports EAP-TTLS with individual user credentials, which still replaces a single shared password with per-user access.
3. Access that follows your directory
Because network access is tied to directory group membership, changes in your identity provider carry through to the network. When someone leaves the organization or changes roles, their network access and segment placement change with them, which closes off stale credentials that attackers often target.
Foxpass also logs access attempts by VLAN and policy. Those records show which users and devices connected, when, and to which segment, which supports the detection work described earlier.
Foxpass controls who gets on the network and where they land. It does not inspect traffic between devices that are already on the same segment, so it works best alongside EDR, least-privilege account controls, and the other practices above.
Shrink your blast radius before an attacker finds it
Lateral movement turns a single compromised device into an organization-wide incident, and the attacker's reach decides how far that incident goes. Limiting which devices can join the network, where each one lands, and which credentials can be reused gives attackers far fewer places to go.
Foxpass helps IT teams put identity and certificate checks on every network connection without running RADIUS or PKI servers in-house. Start a free trial to see how Foxpass fits your network.
