Lateral movement is the post-compromise phase where an attacker pivots from the first infected device to other systems inside the same environment. Instead of staying on one host, the attacker uses stolen credentials, remote administration tools, or trusted protocols such as RDP, SMB, or WMI to reach file servers, domain controllers, or backup systems and gain higher privileges.
This matters because the initial breach is often only the entry point. Real ransomware crews use lateral movement to map the network, locate valuable data, disable defenses, and spread encryption across many machines. Defenders look for unusual logins, repeated authentication failures, unexpected remote execution, and account use outside normal patterns. Network segmentation, least privilege, MFA, hardened admin accounts, and strong endpoint logging all make lateral movement harder to perform and easier to detect.