Island Hopping Attack is a campaign in which an attacker compromises one organisation or environment and uses it as a stepping stone to reach another target. It often relies on trusted connections, shared identity paths or managed service relationships. Defenders should monitor lateral trust, third-party access and anomalous cross-organisation activity.
How Island Hopping Attacks Work
An island hopping attack is less about a single breach and more about chained trust. An attacker turns one compromised environment into a launch point, then uses existing connectivity, shared services or delegated access to reach a more valuable target without immediately looking like an external intruder.
This pattern matters because defenders often harden the primary perimeter while overlooking the relationships between organisations, tenants, partners and managed providers. A foothold in a lower-value environment can still provide access paths that are trusted by the next one in the chain.
Why Trusted Relationships Become the Attack Path
Island hopping usually succeeds when one organisation implicitly trusts another, or when identities, credentials, remote administration paths or service relationships are reused across environments. The attacker does not need to break every boundary, only the one that connects two otherwise separate domains.
That makes this a relationship problem as much as a compromise problem. Cross-organisation activity, federated access, support channels, shared tooling and third-party administration all become high-value routes when the original compromise is not contained. Lateral Movement Guide is useful here because the same techniques that move laterally inside one network often become the bridge between networks once trust is established.
When the attack crosses into agentic or non-human identity territory, the risk is amplified by service accounts, tokens and delegated access that were never designed for interactive scrutiny. The broader breach patterns in The State of NHI & AI Agent Breach Report 2026 show why stolen machine access and overtrusted automation can become the hidden connector between separate environments.
How Organisations Check Whether They Are Exposed
Exposure assessment starts with mapping who can reach whom, through which paths, and under what trust assumptions. Asset inventories need to include partner links, remote support channels, federated identity flows, shared management planes, API trust chains and any privileged service relationship that can be abused as a stepping stone.
Defenders should also review internet-facing services, vendor support arrangements and cross-tenant dependencies for evidence of implicit trust. The question is not only whether a system is patched, but whether a compromised upstream environment could legitimately authenticate, route or administer into a downstream one. CISA advisories are a useful external reference point for tracking active exploitation and exposure trends across the ecosystem, especially where public advisories reflect the kinds of access paths attackers are currently abusing: CISA cyber threat advisories.
Containment, Detection and Recovery
Containment focuses on reducing the usefulness of any single island as a bridge to the next one. Segmentation, explicit trust boundaries, least privilege across partner links and tighter control of remote administrative channels all reduce the chance that a compromise propagates outward through legitimate access paths.
Detection should look for unusual cross-organisation authentication, unexpected administrative activity from trusted peers, abnormal remote support behaviour and access that is valid in one context but unusual in another. Because the attacker may be operating through normal trust, compromise often shows up first as relationship abuse rather than obvious malware telemetry.
Recovery should include a post-compromise review of every dependency that could have been used as the bridge, not just the initially breached host or account. If the access path itself was trusted, then credentials, sessions, keys, federation settings and partner permissions may all need to be reassessed before normal connectivity resumes.
Risk and Threat Considerations
Island hopping is dangerous because it turns trust into reach. A compromise in one organisation can expose multiple downstream targets if shared access, delegated administration or cross-environment trust was broader than intended.
Failure mechanism: The attacker abuses a legitimate relationship, such as partner access, remote support, federated identity or reused credentials, to move from the first compromise into a second environment that treats the connection as trusted.
Impact: The second environment may inherit the attacker’s access, making detection harder and expanding the blast radius beyond the original victim. In the worst case, one weak link becomes a repeatable route into multiple organisations.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST Zero Trust (SP 800-207) and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1021 — Remote Services | Island hopping commonly exploits trusted remote access paths between environments. |
| T1078 — Valid Accounts | Attackers often reuse legitimate credentials or delegated access to pivot across trust boundaries. | |
| Recommendation — Map exposed trust paths to remote-service techniques and monitor them for unusual cross-organisation use. Hunt for valid-account abuse across partner and federated access channels. | ||
| NIST SP 800-53 Rev 5 | AC-4 — Information Flow Enforcement | Island hopping depends on uncontrolled or overtrusted flows between separate environments. |
| Recommendation — Enforce information-flow rules that limit which trusted connections can carry administrative access. | ||
| NIST Zero Trust (SP 800-207) | 3.4 — Policy Enforcement and Least Privilege | Zero trust directly addresses implicit trust between connected environments and partners. |
| Recommendation — Apply least-privilege policy enforcement to every inter-environment access path. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Controlling who can reach what across environments is central to stopping stepping-stone access. |
| Recommendation — Review and remove unnecessary cross-domain access paths and partner permissions. | ||
Practitioner Guidance
Why practitioners should care: The control problem is not just endpoint security, it is trust-path security. If you do not know which external or semi-trusted relationships can carry administrative or authenticated access, you cannot reliably contain an island hopping campaign.
What to watch for: Prioritise review of shared service accounts, remote management channels, partner integrations and any workflow where access in one organisation can be reused in another without a fresh trust decision.
Practitioner takeaway: Treat cross-organisation trust as an attack surface, not a convenience feature.