Lateral movement

Initial access rarely lands an attacker where they want to be. A phished laptop belongs to a regular user, not a domain administrator. So attackers move: harvesting credentials from memory, reusing local admin passwords shared across machines, and connecting to servers through remote desktop, SMB file shares or remote management tools.

In flat networks, where every device can reach every other device, lateral movement is easy. A compromised receptionist PC at a Winnipeg manufacturer might be able to reach the file server, the backup server and the plant's production systems directly.

Defences include network segmentation, unique local administrator passwords (Microsoft's LAPS solution handles this), removing standing admin rights, restricting which machines can be administered from where, and phishing-resistant MFA for privileged accounts. Detection matters too: unusual logins between workstations, new remote service creation and credential dumping attempts are classic signs that EDR and a monitoring team watch for. Catching lateral movement is often the difference between a contained incident and company-wide ransomware.