Lateral movement
Also known as: network lateral movement, lateral spread
Lateral movement is what attackers do after breaking into one computer or account: they move sideways through the network to other systems, collecting passwords and permissions until they reach valuable targets such as file servers, backups, or domain controllers.
It's why a single phishing click can turn into a company-wide ransomware attack. While lateral movement often uses normal admin tools that look legitimate, network segmentation and strong identity controls can make it much harder.
Lateral movement, explained at three levels
At home
Imagine a burglar who gets into one room of an office building, then finds a ring of keys in a desk drawer that opens the next room, where there are more keys. Lateral movement is a hacker doing that inside a computer network: using passwords found on the first computer to sign in to others, one after another, until they reach something valuable.
At work
Lateral movement is what attackers do after breaking into one computer: they use stolen passwords and normal admin tools to sign in to other machines on the network, working toward valuable targets like file servers, backups, or admin accounts. It's how a single phishing click becomes a company-wide ransomware attack. Businesses limit it by separating networks and giving every machine unique credentials.
At home
Once attackers are inside one computer, they look for what it can reach. They collect saved passwords, cached logins and network shares, then use those credentials to sign in to the next machine, just as a normal administrator would. Each new system offers more credentials, and the hunt continues until they find an account that can reach everything, such as a domain administrator. Because they use real logins, much of the activity looks like ordinary work.
At work
In Windows networks, common methods include pass-the-hash and pass-the-ticket, which reuse stolen credential material without knowing the password, plus remote desktop, SMB admin shares, PsExec, WMI and PowerShell remoting. Shared local administrator passwords let one compromise unlock every machine with the same image. Defences include Windows LAPS for unique local admin passwords, tiered admin accounts that never log in to ordinary workstations, blocking workstation-to-workstation traffic, and alerting on unusual internal logins.
At home
Lateral movement also happens between your own accounts and devices. If you use one password for your home laptop, email and work account, an attacker who steals it once can hop between them all. Saved sign-ins in a shared browser have the same effect. In my view, a password manager with a unique password for every account is the simplest way to cut those links, because a stolen key then opens only one door.
At work
Attackers plan movement as a graph problem, and tools such as BloodHound reveal Active Directory paths from any user to domain admin through group memberships, sessions and delegated rights. Defenders use the same graph thinking to remove the shortest paths. Detection draws on identity telemetry, such as Kerberos anomalies and NTLM use, EDR process data and east-west network flows. Microsoft's enterprise access model, Credential Guard and Protected Users group, and zero trust segmentation each remove ways that credentials leak or get reused.
Real-world examples
At home
Fatima's office suffered ransomware. The investigation found attackers broke into one employee's laptop, then used a shared admin password to log into dozens of other computers.
At work
Jerome is a network architect at an Ontario school board. After an incident, he separated staff, student, and admin networks and gave each computer a unique admin password, limiting how far attackers could spread.
How it compares
| feature | Lateral movement | Privilege escalation |
|---|---|---|
| Direction | Sideways to other systems | Upward to more permissions |
| Goal | Reach valuable targets | Gain admin control |
| Common tools | Remote desktop, stolen credentials | Exploits, misconfigurations |
| Key defence | Segmentation and unique credentials | Patching and least privilege |
Attackers climb up and spread out. Both need to be blocked.
For analysts
I'd ask IT one question: if one laptop is compromised, how far could an attacker get? The answer shows how much segmentation and credential hygiene work remains.
History & origin
Attackers have pivoted between systems since the earliest network intrusions, as described in Clifford Stoll's account of tracking a hacker through university and military networks in the late 1980s. The 2013 Target breach began with credentials stolen from an HVAC contractor and spread to payment systems. Benjamin Delpy's Mimikatz tool, released in 2011, made extracting Windows passwords from memory easy and became a staple of attackers. In 2017, NotPetya spread through networks in minutes using stolen credentials and the EternalBlue exploit, causing billions in damage worldwide. Ransomware gangs made lateral movement routine, often spending days quietly spreading before encrypting everything. In my view, lateral movement is the stage where most breaches become disasters, and where many organizations have the least visibility.