Lateral movement is a technique used by cyber attackers to move within a network after an initial intrusion, in order to gain access to systems, data or information. privileges sensitive.
The lateral movement aims to extend the attacker's reach by exploiting vulnerabilities stolen identifiers or legitimate tools.
Objective
- Reaching critical targets (servers, databases, admin accounts)
- Raising privileges to control strategic resources
- Preparing destructive actions (data exfiltration, deployment of ransomware)
π§ Tools
| Method | Explanation |
|---|---|
| Pass-the-Hash | Theft and reuse of password hashes to access other machines. |
| Exploitation of vulnerabilities | Use of unpatched vulnerabilities (e.g. EternalBlue) to propagate the attack. |
| RDP (Remote Desktop Protocol) | Remote access to machines using compromised credentials. |
| PowerShell/WMI | Exploitation of legitimate system tools to execute malicious commands. |
| Trojan horse | Deployment of malware to maintain persistent access and pivot between systems. |
π Examples
- Ransomware After infecting a user workstation, the attacker uses stolen credentials to propagate to the backup servers.
- APT (Advanced Persistent Threat) a state-owned group uses exploits to access a company's administrative network via internal file sharing.
- Phishing internal sending bogus e-mails from a compromised account to infect other employees.
π Detection and prevention
- Internal traffic monitoring :
- Limiting privileges :
- Least Privilege Principle.
- Network segmentation (isolate critical areas).
- Enhanced authentication :
- MFA (Multi-Factor Authentication) for sensitive access.
- Regular password rotation.
- Patch management Fix critical vulnerabilities quickly (e.g. ProxyLogon, PrintNightmare).
Key figures
In France (source: ANSSI, 2023)
- 68 % of serious incidents involve lateral movement to reach critical systems.
- 40 % of attacks use internal tools (e.g. PowerShell) to avoid detection.
In the world
- 87% of data breaches include lateral movement (Verizon DBIR 2023).
- Average cost an attack with lateral movement: 4.7 million (IBM).
- Average time to detect lateral movement : 150 days (Mandiant).
Why is it critical?
- Silencer Attackers often imitate legitimate behaviour
- Exponential impact an initial minor breach can lead to a total network compromise
- Strategic challenge The financial, health and energy sectors are priority targets
⚠️ Challenge : Cloud/hybrid environments make detection more complex (e.g. movement between on-premises and AWS/Azure)
