Ransomware lateral movement is the real hybrid cloud risk

At a glance

What this is: Illumio argues that ransomware lateral movement, not just initial compromise, is the core hybrid cloud risk because attackers can pivot across dynamic east-west traffic.

Why it matters: This matters to IAM and NHI practitioners because the same trust and access paths that enable workload communication also shape blast radius, segmentation design, and containment speed.

Context

Ransomware containment in hybrid cloud depends on more than perimeter defence because once attackers land inside the environment, they can move laterally through workloads, containers, endpoints, and cloud services. The primary security gap is visibility into east-west traffic and the ability to stop spread before an isolated compromise becomes an operational outage.

In this article, Illumio frames hybrid multi-cloud as a control problem as much as a threat problem. That matters to identity teams because workload communication, least-privilege access, and segmentation now influence how quickly an attacker can traverse identities, services, and infrastructure once authentication has already been abused.

Key questions

Q: What breaks when ransomware containment relies only on perimeter tools?

A: Perimeter tools miss much of the east-west traffic that ransomware uses to move inside hybrid environments. Once an attacker has a foothold, internal reachability matters more than the initial alert, and the result is wider spread, slower response, and a much larger blast radius.

Q: What fails when ransomware can move laterally inside hybrid cloud environments?

A: The failure is not just compromise, but containment collapse. Once ransomware can traverse workloads, endpoints, or containers, a single foothold becomes a broader outage. The practical break point is usually overly broad connectivity or access scope, which lets the attacker reach backup systems, admin paths, or data stores before defenders can isolate the first infected system.

Q: How do you know whether segmentation is actually reducing ransomware risk?

A: Segmentation is working if a compromise stays constrained to a small part of the environment and cannot reach administrative planes, backups, or critical business systems. Test that assumption with recovery exercises and controlled movement simulations. If one foothold still has broad reach, the organisation has exposure, not containment, even if detection coverage looks strong.

Q: What should teams do when ransomware starts moving laterally inside a cloud estate?

A: They should isolate the affected workload, cut off unnecessary internal communication paths, and preserve the rest of the environment while triaging scope. The goal is containment before spread, not a broad shutdown that disrupts unaffected services.

Technical breakdown

Why east-west traffic creates a ransomware containment problem

East-west traffic is the internal movement between workloads, services, and systems inside an environment. In hybrid cloud, those communication paths change constantly across public cloud, private data centres, containers, and endpoints, so perimeter tools see only a small part of the attack surface. Once ransomware gets in, it can pivot across these internal paths faster than teams can reconstruct the route. The control problem is not just detection of malicious code, but understanding how trust and connectivity are arranged inside the environment.

Practical implication: Map internal communication paths and restrict unnecessary workload-to-workload connectivity before relying on any containment plan.

Why detection alone arrives too late for lateral movement

Traditional detection often works after suspicious behaviour has already produced damage. In ransomware cases, that delay can mean encrypted systems, disabled backups, or compromised administrative credentials before the SOC fully understands the path of movement. Mean time to detect and mean time to respond matter, but they do not stop spread on their own. The more dynamic the estate, the more the control has to shift from post-event alerting to pre-positioned visibility and intervention at the communication layer.

Practical implication: Treat detection as an input to containment, not as the containment mechanism itself.

How segmentation changes the blast radius of a breach

Segmentation limits how far an attacker can move once one asset is compromised. At the workload level, it is more adaptable than static network zoning because policies follow application relationships rather than fixed subnets or manual firewall boundaries. In a hybrid environment, that matters because the attacker’s practical advantage is speed and internal reach. Effective segmentation reduces the number of reachable systems, which turns a broad incident into a contained one instead of a business-wide outage.

Practical implication: Design segmentation around application relationships so that compromised workloads cannot reach high-value systems by default.

Threat narrative

Attacker objective: The attacker wants to spread ransomware laterally enough to maximise disruption, reach high-value systems, and force operational shutdowns.

1. Entry occurs when ransomware bypasses perimeter controls and lands on an internal workload, endpoint, or server inside the hybrid environment.
2. Credential access or trusted access abuse can then let the attacker reach adjacent systems and pivot through east-west traffic that perimeter tooling does not track well.
3. Escalation follows as the attacker reaches higher-value workloads, administrative paths, or shared services, increasing the blast radius across cloud and on-premises estates.
4. Impact is achieved when multiple systems are encrypted or disrupted, forcing manual operations and business interruption across the environment.

Breaches seen in the wild

• Storm-2949 Azure Breach: Storm-2949 social engineering attack turns one cloud identity compromise into full Azure tenant breach.
• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Ransomware containment has become an internal access problem, not just a malware problem. Once an attacker is inside a hybrid environment, the real question is how far they can move before controls intervene. That shifts attention from perimeter defence to attack-path control, workload segmentation, and live visibility into internal trust relationships. Practitioners should treat east-west exposure as a governance issue, not only a network one.

Attack-path visibility is now a core security control for hybrid cloud estates. Static inventories and after-the-fact logs do not explain how ransomware can traverse containers, workloads, and cloud services in real time. A named concept here is lateral blast-radius control: the ability to limit the internal reach of a compromise before business systems are affected. Teams that cannot model reachability cannot contain movement quickly enough.

Least privilege has to extend to workload communication, not only user access. The article’s underlying point is that internal service relationships can become the routing layer for compromise when they are left too open. That intersects directly with identity governance because machine and workload identities define who can talk to what inside the estate. Practitioners should align segmentation and authorization so that communication paths are as constrained as access entitlements.

Hybrid ransomware resilience will increasingly be judged by containment speed. Prevention still matters, but once controls fail, the decisive variable becomes how quickly teams can isolate affected systems without taking down the whole environment. This is where segmentation, attack-path analysis, and operational response converge. The practical conclusion is simple: if the estate cannot isolate a compromised workload fast, it is not resilient enough.

The market is moving toward controls that observe and enforce the live shape of the environment. Hybrid infrastructure changes too quickly for purely static policy models to keep up. That means teams need controls that understand workload relationships as they change and can enforce containment in real time. For practitioners, the governance question is whether their current architecture can still bound damage when prevention fails.

From our research library:

• 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.

What this signals

Lateral blast-radius control: hybrid resilience now depends on how quickly teams can reduce the internal reach of a compromise, not just how quickly they can detect it. That means workload segmentation, path analysis, and containment policy need to be designed together rather than treated as separate projects.

For practitioners, the governance test is whether identity and network controls describe the same internal trust model. If workload communication remains more permissive than user access, ransomware will keep finding routes around the controls that were meant to stop it.

For practitioners

• Map east-west attack paths Inventory how workloads, endpoints, containers, and cloud services actually communicate so you can identify reachable paths before attackers exploit them.
• Contain compromise at the workload layer Use segmentation to isolate infected workloads quickly rather than relying on broad network shutdowns or manual firewall rework.
• Prioritise internal blast-radius reduction Rank high-value systems by how many internal paths reach them and remove unnecessary connections that let ransomware spread laterally.
• Shift SOC focus from alerts to containment Measure whether the team can identify and stop malicious movement in minutes, not whether it can only detect the anomaly after damage begins.

Key takeaways

• Ransomware containment in hybrid cloud fails when teams focus on perimeter defence but leave internal communication paths broad enough for attackers to pivot.
• The article uses Norsk Hydro to show that once ransomware moves laterally, operational disruption can quickly become enterprise-wide.
• The practical control lesson is to reduce blast radius with segmentation and live attack-path visibility before an incident forces manual containment.

Key terms

• East-west traffic: East-west traffic is communication that moves between systems inside an environment rather than entering or leaving it. In microsegmentation programmes, it is the traffic most likely to expose hidden trust assumptions and is therefore the main target for workload-level policy.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Breach Containment: Breach containment is the act of stopping an attacker from expanding access after detection. It goes beyond alerting by blocking communication paths, isolating workloads, or limiting privilege so the incident remains smaller than it otherwise would have been.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for security teams that need to connect identity governance to workload access, secrets, and operational containment.