Ransomware lateral movement is the real critical infrastructure risk

At a glance

What this is: This analysis argues that ransomware damage in 2025 is driven less by initial compromise than by attackers’ ability to move laterally across networks and hit critical systems at scale.

Why it matters: It matters because identity, segmentation, and privileged access controls now determine whether a single intrusion stays contained or becomes a full-environment outage for IT, OT, and clinical workloads.

By the numbers:

• Ransomware incidents reached over 4,848 publicly posted victims in 2024, according to Elisity.

Context

Lateral movement is the stage where an attacker expands from the first compromised system into adjacent assets, and in ransomware cases that is often what converts a breach into operational shutdown. In this article, the core issue is not malware delivery but the lack of east-west controls that let attackers traverse environments, reach backups, production systems, and other crown jewels. For organisations running mixed IT, OT, and identity-dependent workflows, that is now a governance problem as much as a detection problem.

The article frames ransomware as a network and access-control problem rather than a single-endpoint event. That is especially relevant where service accounts, remote admin tools, and over-permissive trust paths create implicit pathways across zones. In practical terms, the starting position described here is no longer unusual for critical infrastructure and manufacturing environments.

Key questions

Q: What breaks when ransomware can move laterally after one endpoint is compromised?

A: Containment breaks, because one compromised identity can reach the systems that keep the business running. If user networks, management planes, and recovery infrastructure are not separated, attackers can pivot from a single host into domain controllers, backups, and virtualization layers before defenders can isolate the incident.

Q: Why does lateral movement make ransomware more dangerous in complex environments?

A: Lateral movement turns one compromised endpoint or credential into a pathway toward higher value systems. In complex environments, attackers can reuse legitimate access, blend in with normal administration traffic, and reach critical assets before perimeter tools react. That is why ransomware increasingly shifts from simple encryption to exfiltration, extortion, and targeted disruption of core operations.

Q: What are the signs that east-west controls are failing?

A: Warning signs include admin tools appearing in non-admin workflows, accounts reaching far more systems than normal, and movement from one zone to another without a clear business reason. Sudden access to backups or production control systems is especially concerning because it often means the attacker has found a path across trust boundaries.

Q: How should security teams stop ransomware from spreading after an initial breach in flat or overconnected environments?

A: Security teams should assume some intrusions will succeed and focus on containing movement. The practical priority is microsegmentation and Zero Trust Segmentation, so compromised systems cannot easily reach other workloads, identity stores, or critical services. That approach limits blast radius, buys time for response, and reduces the chance that a single foothold becomes a broad operational outage.

Technical breakdown

How lateral movement turns one foothold into enterprise-wide impact

Lateral movement is the post-compromise phase in which an attacker uses valid sessions, remote administration protocols, or stolen credentials to reach more systems than the original entry point allowed. In ransomware operations, this is the multiplier: one endpoint compromise becomes access to file shares, domain services, backups, and operational systems. The attackers do not need to defeat every control individually if the network already assumes internal trust. That is why east-west traffic, not just north-south perimeter traffic, has become the decisive path for modern ransomware crews.

Practical implication: segment internal paths so compromise of one system does not automatically expose the rest of the environment.

Why legitimate tools and remote access obscure attacker activity

Modern ransomware crews routinely abuse legitimate tools such as remote monitoring software, PowerShell remoting, WMI, and RDP because those tools blend into administrator activity. That means the security challenge is not only malicious code detection, but also distinguishing authorised maintenance from unauthorised traversal. When attackers use valid credentials or trusted binaries, controls focused only on malware signatures miss the real movement pattern. For identity teams, this is where privilege scope, device trust, and session control become more important than static account ownership.

Practical implication: monitor privileged remote activity as a control issue, not only as an endpoint malware issue.

Why microsegmentation and Zero Trust change the ransomware attack surface

Microsegmentation limits which workloads can talk to each other, while Zero Trust removes the assumption that an internal location is inherently trusted. Together, they reduce the blast radius of a compromised account or host by forcing re-authorization at each hop. In the article’s framing, this is the practical answer to lateral movement because it constrains east-west trust rather than relying on post-detection cleanup. This also matters for non-human identities, since service accounts, automation tools, and device identities can otherwise become hidden traversal paths across zones.

Practical implication: align segmentation policies and identity policies so machine-to-machine access cannot pivot freely across environments.

Threat narrative

Attacker objective: The attacker’s objective is to maximise operational disruption and ransom leverage by spreading from one foothold into the widest possible set of critical systems.

1. Entry occurs through credential theft, social engineering, or exploited remote access rather than only through malware delivery.
2. The attacker then uses valid tools and stolen access to enumerate systems, identify valuable assets, and move laterally across the network.
3. Escalation reaches backups, production systems, and critical infrastructure controls, allowing the ransomware operator to encrypt or wipe at scale.

Breaches seen in the wild

• Storm-2949 Azure Breach: Storm-2949 social engineering attack turns one cloud identity compromise into full Azure tenant breach.
• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Lateral movement has become the real ransomware control gap: the decisive failure is no longer just initial compromise, but internal trust that allows one foothold to become domain-wide reach. Once adversaries can use valid tools and accepted access paths, detection alone arrives too late to contain the blast radius. The governance problem is therefore east-west trust, not only malware hygiene, and practitioners should treat internal access boundaries as the primary control surface.

Privilege scope is now a resilience issue, not only an IAM issue: the article shows attackers using legitimate remote access and stolen credentials to behave like insiders. That makes over-permissive service accounts, remote admin pathways, and weak internal authorization models directly relevant to ransomware containment. In identity terms, the environment has been granting traversal rights that attackers can reuse faster than traditional review cycles can catch them; practitioners need to assume privilege will be abused before it is reviewed.

Identity-based segmentation is the named control concept this article makes unavoidable: if a workload or user can reach too many adjacent systems, ransomware will use that path. The article’s examples across healthcare, manufacturing, and pharma show that internal trust is the common enabling condition, not the sector itself. That means the security model must shift from perimeter protection to a policy model that constrains which identities can reach which assets, under which conditions, and for how long.

Critical infrastructure ransomware is increasingly an access-governance problem: when IT, OT, and research environments share weak internal pathways, a single credential event can become operational shutdown. The important lesson is not that attackers are more magical, but that many environments still allow broad east-west movement once an identity is accepted. Practitioners should treat segmentation, privileged access, and machine identity governance as one control plane, not three separate programmes.

The control lesson is about limiting traversal, not chasing every stage of malware execution: the article repeatedly shows that by the time encryption starts, the meaningful loss has already happened. That places greater value on preventive internal boundaries, strict device trust, and high-fidelity privilege enforcement for both humans and non-human identities. Teams that continue to optimise only for perimeter or endpoint detection will keep missing the phase that determines impact.

From our research library:

• 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.

What this signals

Identity-based segmentation is now a ransomware resilience requirement: organisations need to stop treating internal movement as routine trust and start treating each reachable path as a control decision. In environments where service accounts, admin tools, and remote support channels already exist, the attack surface is defined by how far one identity can travel before policy intervenes.

Non-human identities are part of the traversal problem: automation accounts, backup credentials, and remote management identities can provide the same internal pathways attackers want after initial compromise. The practical response is to align NHI governance with network segmentation so machine access cannot silently bridge critical zones.

Teams should assume that detection will arrive after meaningful internal movement has already occurred. That shifts priority toward access scoping, trust reduction, and isolating crown jewel assets before ransomware operators can turn one compromised foothold into a broad operational outage.

For practitioners

• Implement east-west segmentation around crown jewel systems Separate user workstations, servers, backups, and operational systems so a single compromised asset cannot move laterally into critical workloads.
• Tighten remote administration pathways Restrict RDP, PowerShell remoting, WMI, and remote support tools to approved admin devices, approved accounts, and approved maintenance windows.
• Reduce trust in service and automation accounts Audit non-human identities that can reach multiple zones and remove standing access that is not required for a specific workload or maintenance function.
• Hunt for suspicious internal traversal patterns Look for accounts that suddenly touch many more hosts than usual, especially where remote tools and authentication events occur in tight sequence.
• Protect backups from the same trust plane as production Isolate backup infrastructure, restrict restore permissions, and verify that the credentials used for backup administration cannot reach production systems.

Key takeaways

• Ransomware impact is increasingly determined by how far attackers can move internally after the first compromise.
• The article ties this pattern to large-scale harm, including over 4,848 publicly posted victims in 2024 and a reported $22 million demand in one case.
• The most effective countermeasure is to constrain east-west trust with segmentation and identity-aware access controls before attackers complete traversal.

Key terms

• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• East-west traffic: East-west traffic is communication that moves between systems inside an environment rather than entering or leaving it. In microsegmentation programmes, it is the traffic most likely to expose hidden trust assumptions and is therefore the main target for workload-level policy.
• Identity-centric segmentation: Identity-centric segmentation is the practice of limiting access by identity, device, and authorised resource rather than by network location alone. It is especially relevant to defence environments because it reduces lateral movement and produces a clearer audit trail for compliance review.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to real-world containment, segmentation, and access decisions.