What Is Lateral Movement in Cyber Security? How Attackers Spread Inside Networks

Lateral movement in cyber security sounds like one specific technique. It isn’t. It covers at least nine distinct methods attackers use to spread through your network once they’re past the front door, and confusing them with each other costs real detection time.

What is lateral movement in cyber security?

Lateral movement is the set of techniques attackers use to move from one compromised system to another inside your network, searching for higher-value targets like domain controllers and sensitive data. MITRE ATT&CK classifies it formally as TA0008, one of 14 tactics in the framework.

Despite covering only 9 top-level techniques and 14 sub-techniques, TA0008 is one of the most consequential tactics in the entire attack lifecycle. It’s the bridge connecting an attacker’s first foothold, often a single low-value workstation, to the systems that actually hold something worth stealing. Every major breach, from SolarWinds to commodity ransomware campaigns, depends on this bridge existing and going unnoticed.

Lateral movement vs vertical movement: a distinction worth understanding

Vertical movement, formally called privilege escalation (MITRE’s TA0004), means gaining higher access on a system you’ve already compromised. Lateral movement means moving to a different system entirely. They’re separate tactics, but attackers almost always chain them together in practice.

A typical sequence looks like this: escalate privileges on host A to steal usable credentials, then use those credentials to move laterally onto host B. Security teams that treat these as the same problem miss the specific control points each one requires, privilege escalation calls for endpoint hardening, lateral movement calls for network-level segmentation and authentication monitoring.

What is an attack vector, and how does it lead to lateral movement?

An attack vector is the specific method an attacker uses to gain initial, unauthorized access to a system, phishing, an unpatched vulnerability, exposed credentials. It answers how they got in. Lateral movement answers what they do once they’re already inside.

This distinction matters because most security spending targets the attack vector, firewalls, email filtering, patch management, while comparatively little goes toward what happens after that first door opens. Attackers count on exactly this imbalance. A phishing email is the vector. Everything that follows, the credential theft and system-hopping covered below, is lateral movement.

Pass the hash: stealing a hash without ever cracking a password

Pass the hash lets an attacker authenticate to other systems using a stolen NTLM password hash directly, without ever cracking it into a plaintext password. It exploits a structural weakness: Windows password hashes stay static across sessions until the password changes.

An attacker who steals a hash from one compromised machine can reuse it to authenticate anywhere that hash is accepted, moving between systems as if they held the real password the whole time. This is why NTLM specifically, not just weak passwords, deserves scrutiny in any lateral movement defense. Environments still permitting NTLM authentication broadly are handing attackers a technique that requires no password cracking at all.

What is Kerberoasting, and how does it differ from pass the hash?

Kerberoasting targets Active Directory service accounts through the Kerberos protocol, letting any authenticated domain user request a service ticket, then crack its password hash offline. Unlike pass the hash, it works entirely offline after the initial ticket request, generating no unusual network activity to flag.

CISA specifically names Kerberoasting as a preferred technique of Russian state-sponsored APT actors, precisely because service accounts often carry weak, rarely-rotated passwords and elevated privileges nobody monitors closely. The detection signal worth knowing: Windows Event ID 4769 logs every ticket-granting request, and a spike in requests for service accounts nobody normally uses is a strong compromise indicator. Where pass the hash reuses something already stolen, Kerberoasting actively harvests crackable credentials from Active Directory’s own normal ticket-granting activity, making it the quieter, more patient technique of the two.

Pass the ticket and Golden Ticket attacks: exploiting Kerberos directly

Pass the ticket reuses a stolen, legitimate Kerberos ticket to authenticate as another user, similar in spirit to pass the hash but targeting Kerberos tickets instead of NTLM hashes. A Golden Ticket attack goes further, forging an entirely new ticket using the domain’s master KRBTGT account hash.

A Golden Ticket is the most severe technique on this list. Once an attacker steals the KRBTGT hash, they can forge tickets granting themselves Domain Admin privileges for up to ten years, and domain controllers cannot distinguish a forged ticket from a legitimate one. Multi-factor authentication and password policies do nothing against it, since the forgery happens entirely outside normal login flows. The only real remedy is resetting the KRBTGT password twice, since a single reset alone doesn’t invalidate every forged ticket already issued. Ransomware operations including Akira actively target Kerberos infrastructure specifically to reach this level of access, and any business running Active Directory without monitoring KRBTGT account activity is running blind against the single most dangerous credential attack in this entire chain.

What is session hijacking, and where does it fit in this chain?

Session hijacking means stealing a valid session token, a cookie or authentication ID issued after login, to impersonate a user without needing their password at all. It bypasses MFA entirely, since the token proves an authentication event that already happened successfully.

Compromised sessions cost organizations an average of $4.45 million per breach, and the technique grew serious enough that a 2025 White House Executive Order specifically mandated new federal guidelines for securing session tokens. Once an attacker hijacks a session, they inherit that user’s exact access level and can move laterally using it, functioning identically to stolen credentials from the network’s perspective. The 2021 CVS Health breach, exposing over a billion patient records through misconfigured databases enabling session hijacking, shows how far this access can reach once obtained.

How fast does this happen? Current breakout time data

Breakout time, the window between initial access and the start of lateral movement, now averages just 29 minutes according to CrowdStrike’s 2026 Global Threat Report, 65% faster than the year before, with the fastest recorded case at 27 seconds.

That number changes the entire defensive calculus. Twenty-nine minutes isn’t a detection-and-response window, it’s barely enough time to read an alert, let alone investigate one manually. This is precisely why CrowdStrike’s own guidance frames detection speed in terms of a 1-10-60 rule, detect within 1 minute, investigate within 10, isolate within 60, since anything slower now runs behind the attacker by design, not by exception.

Detection: monitoring NTLM, Tier 0 assets, and authentication paths

Detecting lateral movement means monitoring authentication patterns specifically, since nearly every technique above uses legitimate protocols and stolen but valid credentials, making the traffic look like normal administrative activity to anything not watching authentication behavior directly.

Prioritize monitoring around Tier 0 assets, domain controllers and the systems that manage them, since these are every technique’s ultimate destination regardless of which method got an attacker there. Track NTLM authentication attempts specifically, flag unusual Event ID 4769 patterns for Kerberoasting, and watch east-west traffic between systems that don’t normally communicate. Cyber Security Solutions Ltd builds exactly this authentication-path monitoring for clients who’ve historically focused detection budget entirely on the network perimeter, missing that the highest-value detection point sits closer to the domain controller than the firewall.

Stopping lateral movement with microsegmentation and Kerberos enforcement

Microsegmentation restricts which systems can communicate with each other by default, meaning a compromised workstation simply can’t reach a domain controller directly even with valid stolen credentials, since the network itself refuses the connection.

Conclusion

Pair segmentation with direct Kerberos hardening: enforce strong, regularly rotated service account passwords to blunt Kerberoasting, restrict NTLM authentication wherever Kerberos can substitute, and monitor KRBTGT account activity continuously given what a Golden Ticket compromise costs. Neither control alone closes this chain completely, segmentation limits where a stolen credential can go, Kerberos hardening limits how many credentials get stolen in the first place, and both need to run together.