Technique
technique:lateral_movement
Also: bouncing between servers, lat move, laterally move, move laterally, moving around the network, moving laterally, moving through the network, network pivoting, pivoting, propagation, self-propagation, spreading around the network, traversing to other systems, went lateral
Movement by the intruder through the environment, including logging into endpoints and maintaining access.
Movement from the compromised web server into other servers and databases on the VTech network.
“He saw numerous other servers on the VTech network”
“He was able to hop into the database”
Movement from an initially compromised server to an administrator’s computer using credentials or an authenticated session.
“move laterally to the admin’s machine”
“We get the information that we need and move laterally onto his machine”
Movement by the intruder through the environment, including logging into endpoints and maintaining access.
“We could see lateral movement”
“logging in to make sure that their stuff was still sitting on these end-points”
Propagation of the scanning program from compromised systems to additional systems.
“upload that same program to the systems it found, and then put that system to work scanning for more systems”
Movement from an initially compromised system to additional systems across the retail network.
“When the hacker is in the network, they can move over to another machine”
Derived classification for exploiting the same vulnerable software across multiple machines and casinos.
“they’d make their way across town hitting different casinos.”
Accessing additional systems and information after initial authentication to the medical provider’s website.
“I had access to all the systems”
Movement through the compromised corporate network to reach domain controllers and other systems.
“When the attackers got into Saudi Aramco, they were able to move around with ease.”
Moving from an initially compromised employee computer through shared credentials to domain controllers and financial systems.
“Now that they have the admin password to one of the computers they’ll try to use that password on another server.”
Movement from an initially controlled system toward other computers and servers.
“I need to lat move. I need to start getting onto some servers.”
Movement from the initially compromised staging server to other servers and ultimately to the main Las Vegas network.
“you now need to figure out how to laterally move or escalate your privileges”
Movement between numerous company networks and systems after obtaining access, inferred from the group’s access to many organizations and accounts.
“having full access to dozens of networks of video game companies”
Movement through a compromised network from one system or account to additional systems and infrastructure.
“pivoting around, moving laterally, and finding what else is in that network”
“being able to move laterally in a network, pivot around”
Moving through accounts, servers, and interconnected network infrastructure after gaining access.
“They started moving through parts of the network, moving through accounts, moving through servers”
The inferred technique of moving from an initially infected computer to neighboring systems using stolen credentials and exploits.
“the worm spread to another machine, and another machine”
“it would then try to use EternalBlue to see if that system was unpatched”
Self-propagation from one user profile or system context to others.
“the code will copy to their profile”
“the code was copied to that person’s profile”
Derived classification for the malware’s presence across multiple Vodafone central offices and telephone exchanges.
“installed in two of their central offices and four of their switches”
Movement from an initially accessed internal network position to additional systems or areas; inferred from the planted-device and internal-access discussion.
“once you’re into those systems, you can very easily transfer out money”
Movement from an initially compromised computer to other computers or deeper parts of a network.
“or move to another computer deeper inside”
Movement from an initially infected employee computer to other computers and systems inside the bank network.
“From there they have to try to hop around to other computers in the network.”
Movement from an infected computer to other computers within the same network.
“it would then look to try to infect every other computer in that local network”
Movement of malware from one computer to another through propagation.
“the virus spread from one computer to another”
Spread of a worm or stolen-password component from one infected machine to other machines in the network.
“a password-stealing tool and then a component that would use those stolen passwords with remote access features to spread among computers”
“a worm that would first try to spread itself to as many other machines as it could”
Not established in the episode; no entity extracted.
Movement from one compromised machine to another to map and maintain access within an environment.
“the ability to move from one machine to another machine”
Movement from one compromised computer or server to other systems in the network.
“they got on this server and then they went lateral to these two servers”
Movement or access from a compromised user’s computer into the police department’s server and network.
“somebody in the mayor’s computer that ended up gaining access to the server through the mayor’s home computer.”
Movement from the compromised MSP infrastructure through customer environments and other systems.
“started pivoting and traversing to other systems in the network.”
Movement from an initially compromised machine to additional machines on the same network.
“we performed some lateral movement and gained access to some other machines on the network”
Pivoting from an initially accessed system through additional computers and servers to reach core infrastructure.
“What he’s doing is a classic example of lateral movement”
“the attacker manages to get a foothold in one system and then pivots around the network”
Movement through a compromised organisation's network after an employee machine is infected.
“they burrowed their way deeper into the NiceHash network, pivoting”
Moving from a compromised internal system to other systems through trust relationships or network access.
“they could use the trust of this computer to access another computer”
Movement through additional systems after an initial foothold in a network.
“do some reconnaissance inside the network and then spread around”
Not applicable as a cybersecurity-network technique here; the episode instead establishes console modification and circumvention techniques.
Movement through compromised devices and systems to access additional hosts, services, or data.
“going through and seeing where they’re at or what they have access to”
Derived classification for moving from an initially accessed computer to other systems such as CCTV and call-recording infrastructure.
“from there was able to get into the CCTV system”
“I could see the IP address of the server that he was using”
Movement from compromised individuals and systems into associated people, networks, file servers, and banking infrastructure.
“we didn’t just send a blind e-mail ... we’ll essentially own their whole world”
“from there he hopped into the server of the bank’s network”
Movement between systems implied by the episode's discussion of attackers operating inside networks.
“if somebody got in this network and set up an automatic script”
Movement by a threat actor between connected servers or hospital environments after gaining initial access.
“Seeing the threat actor bounce around the different servers.”
“they began to pivot to other locations in the environment”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | INVOLVES | VTech Kids’ Toy Hacking case | Derived | 2 |
| incoming | USES | Nation State Actor | Explicit | 10 |
| incoming | USES | threat actor | Explicit | 11 |
| incoming | USES | Carna Botnet | Explicit | 13 |
| incoming | INVOLVES | Retail credit-card breach | Explicit | 15 |
| incoming | INVOLVES | Saudi Aramco cyber-attack (2012) | Explicit | 30 |
| incoming | INVOLVES | Carbanak | Explicit | 35 |
| incoming | USES | Tinker Secor | Explicit | 36 |
| incoming | INVOLVES | Las Vegas Sands cyber-attack | Explicit | 37 |
| incoming | USES | Project Raven | Explicit | 47 |
| incoming | INVOLVES | Operation Glowing Symphony | Explicit | 50 |
| incoming | USES | Samy worm | Explicit | 61 |
| incoming | INVOLVES | Bangladesh Bank heist | Explicit | 72 |
| incoming | USES | WannaCry | Explicit | 73 |
| incoming | USES | Olympic Destroyer | Explicit | 77 |
| incoming | INVOLVES | World Bank network intrusion | Explicit | 91 |
| incoming | INVOLVES | Cloud Hopper | Explicit | 103 |
| incoming | INVOLVES | P. Diddy hotel compromise | Explicit | 109 |
| incoming | USES | Adam Georgeson | Explicit | 113 |
| incoming | INVOLVES | Academy network attack | Explicit | 113 |
| incoming | INVOLVES | NiceHash hack | Explicit | 119 |
| incoming | USES | REvil | Explicit | 126 |
| incoming | USES | Chris Rock | Derived | 151 |
VTech Kids’ Toy Hacking case INVOLVES lateral movement
The hacker moved from the web server to other servers on the VTech network, including database servers.
Derived Confidence 96% · Jack Rhysider EP 2 Details
“He saw numerous other servers on the VTech network, including a database server. He was able to hop into the database”
Nation State Actor USES lateral movement
The operator moves laterally from the compromised web server to the administrator's machine using credentials or an authenticated session.
Explicit Confidence 99% · Nsa EP 10 Details
“I’m probably going to be able to float across that authenticated session and move laterally to the admin’s machine.”
“We get the information that we need and move laterally onto his machine”
threat actor USES lateral movement
The threat actor was observed moving laterally within the client environment during the monitoring and discovery phases.
Explicit Confidence 99% · Andrew EP 11 Details
“We could see lateral movement”
Carna Botnet USES lateral movement
The Carna Botnet propagated by uploading itself to systems it found and using those systems to scan for additional systems.
Explicit Confidence 99% · Jack Rhysider EP 13 Details
“then upload that same program to the systems it found, and then put that system to work scanning for more systems.”
Retail credit-card breach INVOLVES lateral movement
After gaining network access, the attackers moved to other machines and propagated through the environment.
Explicit Confidence 98% · Jack Rhysider EP 15 Details
“When the hacker is in the network, they can move over to another machine to start setting up their malware.”
Saudi Aramco cyber-attack (2012) INVOLVES lateral movement
After gaining access, the attackers moved around the network with ease.
Explicit Confidence 96% · Jack Rhysider EP 30 Details
“When the attackers got into Saudi Aramco, they were able to move around with ease.”
Carbanak INVOLVES lateral movement
After obtaining one administrator password, the attackers reused it on other servers and reached the domain controller.
Explicit Confidence 98% · Jack Rhysider EP 35 Details
“Now that they have the admin password to one of the computers they’ll try to use that password on another server.”
Tinker Secor USES lateral movement
Tinker includes lateral movement in his standard penetration-testing approach and later says he needs to move onto servers.
Explicit Confidence 98% · Tinker Secor EP 36 Details
“initial breach, lateral movement, pivot”
Las Vegas Sands cyber-attack INVOLVES lateral movement
After compromising one server, the attackers attempted to move laterally and escalate privileges across the network.
Explicit Confidence 98% · Jack Rhysider EP 37 Details
“you now need to figure out how to laterally move or escalate your privileges”
Project Raven USES lateral movement
David described moving laterally through compromised networks to reach additional systems and credentials.
Explicit Confidence 98% · David EP 47 Details
“login remotely until you get where you want to go to the domain controller”
Operation Glowing Symphony INVOLVES lateral movement
The operation involved moving through accounts, servers, and the network according to a rehearsed sequence of targets.
Explicit Confidence 97% · Jack Rhysider EP 50 Details
“They started moving through parts of the network, moving through accounts, moving through servers, moving through everything”
“They were pivoting and they were all dependent upon each other”
Samy worm USES lateral movement
The worm self-propagated from profile to profile through visitors who acquired the code.
Explicit Confidence 98% · Jack Rhysider EP 61 Details
“It just kept spreading.”
Bangladesh Bank heist INVOLVES lateral movement
After compromising one computer, the attackers moved around the bank's network.
Explicit Confidence 98% · Jack Rhysider EP 72 Details
“From there they have to try to hop around to other computers in the network.”
WannaCry USES lateral movement
After infecting one computer, WannaCry attempted to spread to other computers inside the local network.
Explicit Confidence 98% · Jack Rhysider EP 73 Details
“it would then look to try to infect every other computer in that local network”
Olympic Destroyer USES lateral movement
The worm used stolen passwords and remote-access features to spread among computers.
Explicit Confidence 98% · Andy Greenberg EP 77 Details
“use those stolen passwords with remote access features to spread among computers”
World Bank network intrusion INVOLVES lateral movement
The attacker moved laterally from one server to other servers after gaining access.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“Once they were in one computer, they were able to traverse the network to get into other computers.”
Cloud Hopper INVOLVES lateral movement
The attackers used stolen credentials to pivot and traverse to other systems, including the domain controller.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“started pivoting and traversing to other systems in the network”
P. Diddy hotel compromise INVOLVES lateral movement
After gaining access, the attackers performed lateral movement to other machines on the hotel network.
Explicit Confidence 99% · MLT EP 109 Details
“we performed some lateral movement and gained access to some other machines on the network”
Adam Georgeson USES lateral movement
Adam moved from one computer to another across the Academy’s network to reach infrastructure systems.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“Adam kept hopping from one system to another”
Academy network attack INVOLVES lateral movement
The attack involved lateral movement across multiple Academy systems and servers.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“What he’s doing is a classic example of lateral movement”
NiceHash hack INVOLVES lateral movement
After compromising an employee computer, the attackers moved deeper into the NiceHash network.
Explicit Confidence 98% · Jack Rhysider EP 119 Details
“they burrowed their way deeper into the NiceHash network, pivoting”
REvil USES lateral movement
After gaining an initial foothold, REvil attackers performed reconnaissance and spread through the network.
Explicit Confidence 98% · Will EP 126 Details
“do some reconnaissance inside the network and then spread around as best they can”
Chris Rock USES lateral movement
The operation involved moving from compromised endpoints into servers and other systems on the target network.
Derived Confidence 91% · Jack Rhysider EP 151 Details
“from there he hopped into the server of the bank’s network”