Lateral Movement
0 confirmed incidents.
VERIS: hacking:Use of stolen credsMITRE ATT&CK: T1570 (Lateral Tool Transfer)T1021 (Remote Services)
MITRE ATT&CK technique names and ids on this page are reproduced and distributed with the permission of The MITRE Corporation. © 2015–2026, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
Lateral movement covers an attacker moving from the system it first compromised to other systems on the same network, rather than the initial break-in itself. It maps to two MITRE ATT&CK techniques: T1021 (Remote Services), using legitimate remote-access tools such as RDP or SSH with a stolen or guessed credential to log into another system, and T1570 (Lateral Tool Transfer), copying tools or malware from one compromised system to the next. This classification describes how an attacker widened its reach inside a network; the personal-data exposure it leads to is usually recorded separately, as exfiltration, once data is actually copied out.
No confirmed incidents currently carry this attack-type classification.
Questions and answers
How many confirmed incidents are classified as Lateral Movement on Breach Census?
0 confirmed incidents are currently classified as Lateral Movement.
Which MITRE ATT&CK techniques does the Lateral Movement classification cover?
This classification maps to MITRE ATT&CK techniques T1570 (Lateral Tool Transfer), T1021 (Remote Services).
What counts as a confirmed incident for the Lateral Movement classification?
An incident counts here once it carries the Lateral Movement attack-type classification and has reached the confirmed status described on the Methodology page; a bare claim or press report is not enough.