Lateral movement
pivoting · network propagation · internal spread · east-west movement · mouvement latéral
The techniques an attacker uses to move from a first compromised machine to others on the network, until reaching the real targets.
In practice
The first infected laptop rarely interests the attacker: the targets are file servers, backups, payroll, the domain controller. To get there, they reuse stolen credentials and legitimate administration tools, which makes their movements hard to tell apart from the IT team’s normal work. This phase can last days, and it is often the last point at which the attack can be stopped before mass encryption or data theft.
Fictional case: an accountant opens a booby-trapped attachment on a Friday. Over the weekend, the attacker picks up an IT support account left signed in on the laptop, then reaches the file server and the backup console. By Monday everything is encrypted, backups included. Segmentation and separate admin accounts would have stopped it at the second step.
How to protect yourself
- Segment the network and filter traffic between workstations: one laptop has no reason to connect to another.
- Separate administrator accounts by tier, following the tiered model ANSSI recommends for Active Directory.
- Deploy an EDR and watch for unusual connections between machines, especially at night and at weekends.
- Require MFA for administration and restrict remote admin tools to dedicated workstations.
