The phishing email got one person’s laptop. That is a bad Tuesday, but it is a survivable one. What turns it into a bad quarter is the next part: the attacker does not stay on the laptop. They look around, find something with more access, and keep going until they reach the thing worth encrypting or stealing. That “keep going” has a name.
What lateral movement is
MITRE ATT&CK, the standard catalogue of attacker behaviour, defines it in one line: “Lateral Movement consists of techniques that adversaries use to enter and control remote systems on a network.” It is the tactic that sits between getting in and getting what they came for.
Notice what is missing from that definition: exploits. Much of lateral movement is attackers using the same tools your administrators use. MITRE’s Remote Services technique says adversaries “may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC”, and it names RDP and SSH as the usual carriers. In a domain, it notes, a single set of credentials can grant access across much of the network. To your logs, the attacker looks like someone doing their job.
How attackers do it
Three patterns cover most of it.
Valid accounts over remote services. The attacker logs in to the next machine over RDP or SSH with a credential they have already stolen. No malware needed, no alarms by default.
Reusing credential material. MITRE describes pass the hash as “a method of authenticating as a user without having access to the user’s cleartext password.” The attacker takes a stolen password hash and presents it as the login, skipping the password entirely.
Shared local admin passwords. Microsoft puts it directly: “Local administrator accounts often share the same password across many devices, which bad actors can exploit to move laterally across your environment.” Crack one machine, and you have the keys to every machine built from the same image.
The destination is usually a domain controller. CISA’s ransomware guide warns that “malicious actors often target and use DCs as a staging point to spread ransomware network wide”, and that threat actors often get in through “exposed and poorly secured remote services” and then traverse the network with the native Windows RDP client.
How to stop it
You cannot make the first compromise impossible. You can make the second one hard. These controls come straight from CISA’s guide and MITRE’s mitigation lists, roughly in order of payoff per hour of work.
| Control | What it breaks | Source |
|---|---|---|
| Network segmentation | Machines can only reach the zones they need | CISA: it “can help contain the impact of any intrusion” |
| Unique local admin passwords (LAPS) | One cracked machine no longer opens the rest | Microsoft Windows LAPS: protects against “pass-the-hash and lateral-traversal attacks” |
| Separate admin accounts | A phished user account is not an admin account | CISA: “Separate administrator accounts from user accounts” |
| Limit RDP and SMB | Fewer doors between machines | CISA: “Limit the use of RDP and other remote desktop services”; block TCP 445 at the boundary |
| Limit credential overlap | A stolen credential works in fewer places | MITRE (Pass the Hash mitigation): limit credential overlap across systems |
| Audit remote logins | You see the movement while it happens | MITRE, Remote Services: Audit |
A few notes on the table.
Segmentation does the heavy lifting, and it is also the most work. CISA’s wording is modest: segmentation “can help contain the impact of any intrusion”. The goal is not a perfect map of zones. It is that your file server cannot talk to your domain controller just because they share a switch.
Admin hygiene is cheaper than it sounds. CISA’s list includes applying “the principle of least privilege to all systems and services”, allowing “designated admin accounts to be used for admin purposes” only, and restricting access to domain controllers to the Administrators group. LAPS is built into supported Windows versions and Microsoft says it is available at no cost.
Close the doors between machines, not just the one to the internet. CISA’s advice is “Do not expose services, such as remote desktop protocol, on the web”, and for SMB, block TCP port 445 inbound and outbound at the organisation boundary. If workstations do not need to RDP to each other, nothing should allow it. We covered the external half of this in is it safe to expose RDP to the internet.
Why a perimeter alone does not cut it
NIST’s zero trust architecture (SP 800-207) starts from the opposite assumption to the flat network: “Zero trust assumes there is no implicit trust granted to assets or user accounts”, and it “focuses on protecting resources (assets, services, workflows, network accounts, etc.), not network segments.” In practice that means being on the internal network is not itself a reason to be let in.
You do not need to adopt a whole architecture to benefit. The useful question is the one lateral movement forces on you: if this one machine were fully compromised tonight, what could it reach tomorrow?
Where SSHepherd fits
Lateral movement over SSH and RDP depends on those services listening on the machines the attacker lands next to. SSHepherd® closes externally exposed listening ports, and servers and users connect outbound to a broker, so there is no open admin port on a server for a compromised neighbour to try. Sessions can be monitored, recorded and ended on demand, which covers the “audit your remote logins” line in the table. It does not replace segmentation, LAPS or endpoint protection; it removes one path attackers rely on. See the server-to-server use case and the SSHepherd page.
The bottom line
Lateral movement is the part of an attack you still have a chance to stop. Assume one machine will fall, then make sure it cannot take the rest with it: segment, give each admin account and each local password its own scope, close the remote ports between machines, and log the sessions that remain.