Lateral movement in ransomware is the real blast-radius problem

At a glance

What this is: This analysis argues that lateral movement is the decisive phase in ransomware campaigns because it turns a single foothold into broad operational disruption.

Why it matters: It matters to IAM, PAM, and NHI teams because the controls that limit east-west spread are the same ones that constrain privileged access, machine trust, and blast radius.

By the numbers:

• The average cost of a data breach reached $4.88 million globally, according to IBM's 2024 Cost of a Data Breach Report cited by Elisity.
• Breaches involving stolen credentials took 292 days to identify and contain, according to IBM's 2024 Cost of a Data Breach Report cited by Elisity.

Context

Lateral movement is the phase where an attacker pivots from one compromised system to others inside the environment. In ransomware incidents, that phase determines whether an intrusion stays local or becomes a broad business outage across users, servers, and operational systems.

For identity programmes, the issue is not simply detecting a bad login. It is stopping compromised credentials, trusted admin protocols, and remote tools from being reused across the internal estate once an initial foothold exists.

Elisity's framing is especially relevant to organisations with flat networks, shared administrative pathways, and high-value systems such as domain controllers, backup platforms, and virtualisation management planes.

Key questions

Q: What breaks when ransomware attackers get valid credentials instead of exploiting a vulnerability?

A: When attackers authenticate with stolen credentials, perimeter controls lose most of their value because the session looks legitimate. The real failure is unchecked access scope. If the identity can reach production, backups, or identity systems, the attacker can move laterally, escalate impact, and force shutdown decisions before defenders fully understand the blast radius.

Q: Why do stolen credentials make ransomware outbreaks harder to contain?

A: Stolen credentials matter because they turn the attacker into a valid user, which often bypasses basic trust checks. If those credentials belong to privileged users or support staff, the operator can enumerate systems, request access, and move through approved channels. That is why identity lifecycle, MFA resistance, and privilege scoping are central to containment.

Q: How do security teams know if lateral movement defences are actually working?

A: Teams should test whether one compromised identity can reach adjacent systems, SaaS apps, or production zones that it should not access. If the answer is yes, segmentation or identity policy is too permissive. Effective controls show up as blocked traversal attempts, rapid isolation, and limited blast radius during simulations.

Q: What should organisations do when administrative tools are being abused for lateral movement?

A: Reduce where those tools can operate, tie them to designated management paths, and monitor them as privileged activity. RDP, SMB, WMI, PsExec, and remote access software should never be broadly available across the internal network.

Technical breakdown

How ransomware operators use trusted administrative paths

Ransomware groups do not need exotic exploits once they are inside. They commonly abuse RDP, SMB administrative shares, WMI, PsExec, and remote access tools to move laterally using mechanisms that look normal to network controls. That works because the internal network often treats authenticated east-west traffic as trustworthy even after the initial compromise. Once an attacker has valid credentials or a foothold on a management host, the same tools used by administrators become the attack path. The real weakness is not one protocol alone, but the combination of trust, reach, and weak segmentation.

Practical implication: Restrict administrative protocols to designated management paths and treat remote tooling as a monitored privilege, not a general convenience.

Why credential theft turns one breach into many

Credential harvesting is the force multiplier in ransomware campaigns. After stealing passwords, hashes, or tokens, attackers can reuse legitimate access to reach more hosts without triggering perimeter alarms. This is why compromised service accounts, privileged admin accounts, and reused credentials are so dangerous: they convert a single endpoint incident into a repeatable internal movement pattern. In the article's examples, the attacker value comes from obtaining the identity context that unlocks other systems, not from the first compromised device itself. That is the mechanism behind blast-radius expansion.

Practical implication: Prioritise credential containment, privilege scope reduction, and rapid rotation for any account that can reach multiple systems.

Why flat networks fail against east-west ransomware spread

Flat or loosely segmented networks assume that internal traffic is low risk. Ransomware operators exploit that assumption by moving from user endpoints toward domain controllers, backup systems, hypervisor management, and industrial or clinical infrastructure. Identity-based microsegmentation matters because it ties access to who or what is connecting, not just where traffic originates. Without that boundary, attackers who obtain a valid internal foothold can traverse large parts of the estate with little friction. The article's core lesson is that blast radius is a network design problem as much as an endpoint problem.

Practical implication: Build segmentation around privilege zones and management planes, then verify that internal authentication does not imply internal reach.

Threat narrative

Attacker objective: The attacker wants to spread fast enough to encrypt critical systems, break recovery paths, and maximize the operational impact of the ransomware event.

1. Entry begins with phishing, loader malware, edge-device exploitation, or purchased access that gives the attacker a foothold inside the network.
2. Credential access follows as the attacker harvests passwords, hashes, or other valid credentials that can be reused on trusted internal systems.
3. Escalation and lateral movement occur when those credentials are used through RDP, SMB, WMI, PsExec, and remote tools to reach domain controllers, backup systems, and management planes.
4. Impact arrives when ransomware is staged and deployed across multiple systems, turning a single compromise into broad operational shutdown.

Breaches seen in the wild

• Storm-2949 Azure Breach: Storm-2949 social engineering attack turns one cloud identity compromise into full Azure tenant breach.
• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Lateral movement is the blast-radius control point, not an endpoint afterthought. The article shows that ransomware operators already understand internal trust boundaries better than many defenders do. Once an attacker can reuse legitimate access inside the estate, perimeter detection no longer defines containment. The practical conclusion is that east-west reach must be governed as tightly as north-south access.

Identity and segmentation are now a single control plane for ransomware resilience. The article connects credential theft, trusted admin protocols, and network design into one failure chain. That means IAM, PAM, and segmentation cannot be treated as separate programmes with separate success metrics. Practitioners need to evaluate whether a compromised account can still reach multiple business-critical zones.

Standing privilege is the condition ransomware groups monetise. When administrative rights persist across many systems, the attacker does not need new access for each hop. That is why blast radius grows so quickly in environments with broad admin reach, reusable credentials, and weak management-plane isolation. The field should treat privilege scope as a resilience issue, not just an access-control issue.

Identity-based microsegmentation is the right named concept for this problem. It is not just segmentation by subnet or VLAN, but enforcement of access boundaries based on identity, privilege, and system role. The article's examples show why that matters for domain controllers, backups, hypervisors, and operational technology. The practitioner implication is simple: internal trust must be expressed as policy, not assumption.

Ransomware containment now depends on controlling where valid credentials can travel. The article makes clear that once trusted tools and administrative protocols are available, the attack blends into normal operations. That shifts the governance question from whether access is approved to whether approved access is still safe when stolen or repurposed. Security teams need to measure internal reach, not just authentication success.

From our research library:

• Half of 1,100 global security leaders surveyed by CrowdStrike believed they were very well prepared for ransomware, yet 78% of their organisations had been attacked in the past year.

What this signals

Identity-based microsegmentation is now a ransomware resilience requirement. Flat network assumptions fail when attackers can reuse valid credentials and trusted tools to traverse internal systems. The programme question is whether a compromised account can still reach recovery systems, management planes, and production assets before containment triggers.

Ransomware defence should be measured by internal reach reduction, not by perimeter alert volume alone. If domain controllers, backup platforms, and virtualisation management remain reachable from general user networks, the blast-radius problem is still unresolved.

For practitioners

• Tighten privileged protocol reach Limit RDP, SMB, WMI, PsExec, and remote access tools to designated jump hosts and management networks. Do not allow general user networks to reach domain controllers, backup systems, or hypervisor management interfaces.
• Segment recovery and management planes Separate backup infrastructure, virtualization management, and operational technology from standard user traffic so a compromised workstation cannot pivot into recovery systems or production control paths.
• Reduce reusable credential reach Apply just-in-time privilege for high-value administrative access and rotate credentials immediately after suspected compromise, especially for accounts that can touch multiple hosts or sites.
• Hunt for east-west movement signals Monitor for many-host authentication bursts, simultaneous service creation across systems, Group Policy changes, tunnelling tools, and unexpected remote tool installations outside approved windows.
• Treat backup and domain assets as Tier-0 Assume domain controllers, backup platforms, and management planes are top-priority targets and enforce stronger identity, segmentation, and monitoring controls around them than around ordinary user systems.

Key takeaways

• Ransomware operators convert one compromised endpoint into broad disruption by combining credential reuse, trusted admin protocols, and weak east-west controls.
• The article ties major impact to internal movement rather than initial access, with IBM cited for a $4.88 million average breach cost and 292 days to identify and contain stolen-credential cases.
• The most effective containment strategy is to narrow credential reach and isolate recovery and management planes before attackers can reach them.

Key terms

• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Identity-based Microsegmentation: A segmentation approach that uses identity, context, and policy to decide whether a connection should be allowed inside a network zone. In OT, it helps reduce lateral movement without relying only on IP addresses or broad subnet rules.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.