Lateral movement is the set of techniques attackers use to spread from the first system they compromise to other systems in the same network. Their real target, such as a file server, a domain controller or a backup system, is rarely the first machine they reach. MITRE ATT&CK treats lateral movement as its own tactic (TA0008).

How it works

• Attackers collect credentials from the first host, for example from memory or saved files.
• They use remote services such as RDP, SSH, SMB or remote management tools to log in elsewhere (T1021).
• They often rely on built-in system tools, a practice known as living off the land, to blend in.
• Each new system gives more credentials and a better view of the network.

Why it matters for defenders

Lateral movement is the stage where a single infected laptop becomes an organization-wide incident. Network segmentation, limited admin rights, privileged access management and monitoring for unusual remote logins all slow it down. A zero trust approach also limits how far one account can reach. The starting point is often a stolen login bought from an access broker, so leaked remote-access credentials are worth catching before anyone uses them.

Sources: MITRE ATT&CK TA0008: Lateral Movement, MITRE ATT&CK T1021: Remote Services