Ransomware resilience depends on stopping lateral movement, not just entry

At a glance

What this is: This ColorTokens advisory argues that ransomware resilience fails when organisations focus on entry prevention and ignore the internal movement that follows compromise.

Why it matters: It matters because IAM, PAM, and broader security teams need controls that constrain post-entry access, not just perimeter defences that can fail under real attacker pressure.

Context

Lateral movement is the phase where an attacker turns a foothold into operational control. In this advisory, the security gap is not only how attackers get in, but how flat networks, exposed VPNs, and weak internal segmentation let them spread after initial access.

For identity and access teams, that creates a governance problem as much as a detection problem. Credentials, VPN sessions, backup-server access, and endpoint protection all become part of the attack path once the first boundary is crossed, so containment has to be designed into the access model itself.

Key questions

Q: What breaks when lateral movement controls are too weak?

A: When lateral movement controls are too weak, one compromised identity can pivot into many systems, turning a local incident into a broad breach. The failure is not just in detection. It is in reachability, overprivileged access, and weak containment. If attackers can move laterally, the environment has already granted too much internal trust.

Q: Why do valid VPN credentials still create ransomware risk?

A: Valid VPN credentials create risk because authentication proves only that a secret or session was accepted, not that the user or device is safe. If attackers have stolen OTP seeds, reused passwords, or compromised endpoints, they can log in and immediately start discovery, credential harvesting, and internal spread. Identity assurance must therefore extend beyond the login event.

Q: What are the signs that internal containment is failing?

A: Look for flat network paths, development and production systems that can talk too freely, privileged accounts with broad reach, and alerts that only fire after suspicious traffic has already spread. If a single compromise can touch multiple critical services, containment is not working as designed.

Q: Should organisations prioritise segmentation over faster patching when discovery outpaces remediation?

A: They should do both, but segmentation becomes the more urgent risk reducer when exploit creation moves faster than patch cycles. Faster patching still matters, yet it cannot eliminate exposure in time for every high-severity issue. Containment buys the time patching needs and limits the business impact when a flaw is exploited before remediation completes.

Technical breakdown

Why perimeter controls fail once attackers are inside

Perimeter controls answer a narrow question: did the request come from outside the network? They do not govern what happens after authentication, exploitation, or credential abuse succeeds. In ransomware and intrusion campaigns, that gap matters because attackers often pivot quickly from a compromised edge device or VPN session into internal assets that still trust one another too broadly. Microsegmentation changes the trust model by reducing which systems can talk to each other, but its real value is that it turns internal movement into an exception rather than the default. That is a governance control as much as a network one.

Practical implication: map internal trust paths and remove broad east-west reach before a breach proves the gap.

How stolen credentials turn a login into a spread path

The SonicWall case in the article shows how valid credentials, stolen OTP seeds, and reused access can bypass MFA assumptions when identity artefacts are already compromised. Once attackers authenticate, they can use common administrative tools and directory queries to discover backup servers, harvest more credentials, and disable protection controls. At that point, identity becomes the transport mechanism for the attack. This is where standing access, credential reuse, and weak secret hygiene matter more than the initial login event, because authenticated access can still be hostile access.

Practical implication: treat authenticated sessions as potentially compromised until credential reuse, seed rotation, and privileged access scope are tightly governed.

What microsegmentation actually interrupts in a ransomware chain

Microsegmentation does not stop every intrusion, but it can break the progression from foothold to enterprise-wide impact. The mechanism is simple: workloads, servers, and user zones are separated so that an attacker who reaches one segment does not automatically inherit routes to backups, domain services, or endpoint management systems. That matters for ransomware because the attacker objective is usually to disable response options, expand reach, and increase the chance of extortion leverage. Limiting those routes forces the intruder to spend more time, create more noise, and cross more explicit policy boundaries.

Practical implication: segment backup, identity, and management networks first, because those are the paths that most often convert access into outage.

Threat narrative

Attacker objective: The attacker objective is to turn a single foothold into durable internal access that supports extortion, data theft, and operational disruption.

1. Entry occurs through exposed VPN interfaces, stolen credentials, phishing-delivered malware, or vulnerable edge devices that provide an initial foothold.
2. Credential abuse and internal discovery let attackers enumerate systems, harvest more access, and disable defences while moving through the environment.
3. Lateral movement reaches backup servers, endpoint controls, and sensitive data stores, which increases persistence and expands the blast radius.
4. Impact is ransomware deployment, data theft, operational disruption, and in some cases long-lived access for follow-on criminal activity.

Breaches seen in the wild

• Cisco Active Directory credentials leak 2025: Kraken leaked Cisco Active Directory hashes, including service and krbtgt accounts; Cisco says they came from its 2022 breach, not a new one.
• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Blast-radius control is now the decisive ransomware control: the article shows that entry prevention alone does not change the outcome once attackers gain a foothold. The real control question is whether the attacker can reach backups, identity services, and management planes after the first compromise. Organisations that still rely on perimeter assumptions are measuring the wrong boundary, so containment architecture must be treated as a primary governance requirement.

Lateral movement is an identity problem as much as a network problem: the SonicWall example demonstrates that stolen credentials, OTP seeds, and reused access can collapse MFA value after compromise. That means privileged access scope, credential rotation, and session containment matter even when authentication appears to succeed. For identity programmes, the lesson is that trust must be reassessed at the point of use, not just at login.

Microsegmentation should be understood as a control over trust inheritance: once one segment is breached, unmanaged internal trust lets the incident propagate into the rest of the enterprise. That propagation is what turns ordinary intrusion into ransomware-scale impact. Security teams should therefore measure whether backups, endpoint management, and directory services are still reachable from a compromised workstation or VPN session.

The article exposes a standing-privilege assumption that modern attacks exploit immediately: defenders often assume access remains limited to the original user or device context, but attackers use the first session to discover the next one. That is a control gap, not just a visibility gap. Practitioner conclusion: collapse standing reach, shorten internal trust chains, and make every sensitive route explicit and policy-enforced.

What this signals

Microsegmentation is becoming a resilience control, not an optional architecture choice: the article’s core message is that containment determines whether an intrusion becomes a business outage. Teams should check whether backups, identity services, and management planes are still reachable from ordinary user segments, because that is where ransomware operators gain leverage.

Standing internal trust is the hidden failure mode: once attackers have one valid login or one compromised device, the absence of strong east-west boundaries lets them keep moving with little resistance. For practitioners, the signal is clear. Access governance has to extend into the network path, not stop at authentication.

Ransomware response planning should assume post-entry activity will happen fast: internal enumeration, credential harvesting, and defence impairment are the moments that matter most. Organisations that wait for encryption before acting are already late, so the programme question is whether containment and detection are designed to interrupt movement before attacker control expands.

For practitioners

• Implement microsegmentation around critical internal assets Separate backup systems, directory services, endpoint management, and user workstations so a single foothold cannot reach them by default.
• Reset and rotate VPN-related credentials and OTP seeds Reissue access artefacts for remote access paths that may have been exposed in prior incidents, and review whether any reused secrets still allow authentication.
• Reduce trust in authenticated internal sessions Assume a valid VPN login or workstation session may be hostile until access scope, host posture, and downstream reach are verified.
• Prioritise patching of exposed edge devices Treat internet-facing VPN and firewall appliances as urgent remediation targets, especially where scans show they remain reachable online.
• Monitor for post-compromise activity inside the network Look for internal RDP, SMB, dsquery, BloodHound, and Impacket activity, because those signals usually appear after the initial breach rather than before it.

Key takeaways

• The article’s central warning is that ransomware resilience depends on limiting what attackers can reach after the first compromise.
• Cisco firewall exposure, SonicWall VPN abuse, phishing-delivered malware, and exposed healthcare data all reinforce the same pattern of post-entry spread.
• Microsegmentation, credential hygiene, and internal activity monitoring are the controls that most directly reduce blast radius.

Key terms

• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• VPN Session: A VPN session is an authenticated remote access connection that extends a user or device into an internal network. If the underlying credentials, OTP seeds, or endpoint posture are compromised, the session can become a direct route for internal discovery and lateral movement.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps identity and security practitioners connect access controls to real-world blast-radius reduction.