Lateral movement is now an identity and data problem

At a glance

What this is: Panther frames lateral movement as a post-compromise technique that turns valid credentials and trusted admin tools into broader breach reach across cloud and enterprise environments.

Why it matters: It matters because IAM, endpoint, and cloud teams have to detect misuse of legitimate access paths, not just block obvious malicious traffic, and that changes how identity telemetry is analysed.

By the numbers:

• Global damages from NotPetya exceeded $10 billion.
• Kubernetes-related threat activity increased 282% between 2024 and 2025.

Context

Lateral movement is what happens after an attacker gets inside: they use legitimate credentials, trusted tools, and valid remote protocols to move from one system to another. In cloud and hybrid environments, that path increasingly runs through identities, service accounts, and workload tokens rather than only through host-to-host compromise.

The governance gap is that many monitoring models still expect malicious traffic to look obviously malicious. IAM, PAM, and cloud security teams need to account for post-authentication abuse, where the same access mechanisms used by administrators can also be used by attackers.

In Panther’s framing, the cloud control problem is no longer just network containment. It is identity-aware detection across systems, because the starting position for many environments is still too permissive to stop movement once one account or host has been taken over.

Key questions

Q: Why do excessive permissions on service accounts and cloud roles increase identity risk in complex enterprises?

A: Excessive permissions expand the blast radius of any compromised identity because attackers can move laterally, access sensitive systems, and pivot into cloud workloads or directory services. In complex environments, standing access is harder to audit and revoke, especially when identities change quickly. Least privilege works best when teams continuously compare granted access with actual usage.

Q: Why do trusted admin tools make lateral movement harder to detect?

A: Tools such as RDP, WMI, PsExec, SSH, and PowerShell are legitimate administration channels, so their use does not automatically indicate malicious activity. Attackers benefit because these tools generate valid authentication and expected process lineage. Teams need contextual correlation, not simple protocol blocking, to separate routine operations from adversary use.

Q: How should security teams detect identity compromise before lateral movement starts?

A: Start by linking authentication, privilege use, and sensitive workflow activity in one detection model. A valid login is not proof of safety if the same identity then resets passwords, accesses admin consoles, or touches cloud entitlements outside normal patterns. The goal is to surface misuse quickly enough to contain the session before it becomes a broader compromise.

Q: What should teams do when a cloud finding affects identity access?

A: Teams should treat the finding as both a security issue and an identity governance issue. The immediate task is to identify the roles, policies, and delegated permissions that made the path possible, then retest after the fix. That approach is more reliable than relying on owners to confirm the issue is resolved in their own systems.

Technical breakdown

Reconnaissance creates the internal map attackers need

Before an attacker can move laterally, they need to identify what is worth reaching and which paths will work. Common discovery steps include domain enumeration, host discovery, and environment mapping with tools such as net view, arp, netstat, and PowerShell modules. These commands are ordinary administrative methods, so the technical challenge is not that they are unusual, but that they are often indistinguishable from routine operations without baseline context. Once an adversary has mapped the environment, credential theft becomes far more targeted and efficient.

Practical implication: log discovery activity with enough context to tell routine administration from pre-compromise mapping.

Credential theft turns trust into movement

Lateral movement usually becomes viable when attackers harvest reusable authentication material such as hashes, tickets, or service account secrets. Techniques such as Pass-the-Hash and Pass-the-Ticket let an adversary authenticate without the original password, while Kerberoasting targets service account material that can be cracked offline. In cloud environments, the same pattern appears through IAM role credentials, Kubernetes service account tokens, and exposed API keys. The important point is that the credential itself becomes the transport layer for movement, not just a method of login.

Practical implication: reduce the value and lifetime of reusable credentials so stolen authentication material cannot carry an attacker far.

Trusted admin tools hide the final hop

Remote access tools such as RDP, WMI, PsExec, SSH, and WinRM are central to legitimate operations, which makes them attractive for attackers once credentials are stolen. At that stage, the problem is not execution by malware alone, but execution through normal administrative channels that generate valid authentication and expected process lineage. In cloud environments, role chaining and workload identity abuse play the same role. Detection therefore has to combine identity, process, and east-west network data, because any single source is usually too narrow to show the full path.

Practical implication: correlate authentication events with process and network telemetry so valid admin channels still surface abuse.

Threat narrative

Attacker objective: The attacker’s objective is to convert one compromised system or identity into durable access across additional systems, workloads, or cloud tenants.

1. Entry begins after the initial foothold, when attackers map the internal environment to identify domain controllers, cloud roles, or other high-value targets.
2. Credential access follows as they steal hashes, tickets, service account secrets, or cloud workload credentials that can be reused across systems.
3. Escalation and lateral movement occur when those credentials are used through trusted tools such as RDP, WMI, PsExec, SSH, or IAM role chaining.
4. Impact is broader compromise, because one stolen identity or host can become a launch point for deeper access across the environment.

Breaches seen in the wild

• Storm-2949 Azure Breach: Storm-2949 social engineering attack turns one cloud identity compromise into full Azure tenant breach.
• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Cloud lateral movement is now an identity governance problem, not just a detection problem. The article makes clear that attackers are not relying on exotic exploits once they are inside. They are abusing the same authentication and administration pathways that legitimate teams depend on, which means cloud security posture alone will not contain the blast radius. Practitioners need to treat identity path control as part of lateral movement defence, not as a separate IAM concern.

Identity resolution is the named concept that matters here. The article shows that Okta, Windows, and cloud logs speak different identity dialects, so movement only becomes visible when those identifiers are normalised and correlated. Without that layer, analysts manually stitch together signals that should already be linked. The practitioner implication is that detection architecture has to recognise the same identity across providers, endpoints, and cloud control planes.

Standing privilege is the failure mode attackers exploit most consistently. Service accounts, IAM roles, and cloud tokens often remain valid long after the operational need has changed, which gives attackers reusable access once one secret is exposed. That is why the problem is not simply secret leakage, but secret persistence inside active privilege paths. The governance conclusion is straightforward: if privilege outlives its need, lateral movement remains cheap.

Perimeter thinking fails because lateral movement is built on legitimate behaviour. PowerShell, RDP, WMI, SSH, and Kubernetes token use all produce valid events, so blocking them outright is neither practical nor desirable. The real question is whether organisations can distinguish expected administration from adversary reuse of the same tools. That shifts the field toward behavioural analysis, data completeness, and identity-aware correlation as the decisive controls.

Cloud and NHI teams now share the same blast-radius problem. IAM role chaining, service account tokens, and workload identities are not edge cases in this article, they are core movement vectors. That means NHI governance, secrets hygiene, and workload access scoping sit directly inside the lateral movement threat model, not adjacent to it. The practical conclusion is that machine identity controls have to be designed for containment, not just authentication.

From our research library:

• 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.
• Read next: Top 10 NHI Issues

What this signals

Identity-aware detection has become the practical control boundary for lateral movement. Security teams can no longer rely on any single telemetry stream to explain what happened. The useful signal emerges only when cloud IAM, endpoint process data, and east-west traffic are normalised into one investigative view, because attackers are using the same legitimate access paths that administrators use.

Service account hygiene now belongs in the same conversation as lateral movement containment. In cloud and Kubernetes environments, machine credentials are not peripheral assets. They are movement accelerators, so over-scoped or long-lived identities should be treated as exposure multipliers rather than simple account-management issues.

For practitioners

• Inventory identity paths that can be reused for movement Map service accounts, IAM roles, cloud workload identities, and admin accounts that can authenticate across multiple systems or clusters.
• Reduce the lifetime of reusable credentials Rotate secrets, revoke dormant access, and replace static keys with workload-native identities where possible so stolen material has less utility.
• Correlate identity, process, and network telemetry Join authentication events with process lineage and east-west traffic so the same action is visible across Okta, endpoints, and cloud logs.
• Hunt for discovery-before-movement sequences Look for internal mapping activity such as net view, nltest, PowerShell discovery, or sequential host probing before high-value authentication events.
• Scope cloud privileges to limit lateral reach Review IAM role chaining, Kubernetes service account permissions, and wildcard entitlements that let one compromised identity reach multiple systems.

Key takeaways

• Lateral movement in cloud environments is increasingly an identity problem because valid credentials, role chaining, and workload tokens let attackers reuse trusted access paths.
• The detection challenge is not the absence of activity but the ambiguity of legitimate admin tools, which makes correlation across identity, process, and network data essential.
• Containment depends on shrinking reusable privilege, limiting identity reach, and building behavioural analytics that can distinguish administration from adversary reuse.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management for practitioners who need to reduce identity-driven attack paths. It helps security and identity teams align lifecycle control with real-world breach containment.