Topic starter
11/07/2026 2:01 pm
TL;DR: Ransomware crews can turn one compromised endpoint into broad disruption through lateral movement, with Elisity reporting that Black Basta, Akira, and LockBit rely on it. Internal reach, not perimeter loss, determines how far a breach can spread before defenders can contain it.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “How to Stop Lateral Movement in Black Basta, Akira, and LockBit Ransomware Attacks”.
By the numbers:
- The average cost of a data breach reached $4.88 million globally, according to IBM's 2024 Cost of a Data Breach Report cited by Elisity.
- Breaches involving stolen credentials took 292 days to identify and contain, according to IBM's 2024 Cost of a Data Breach Report cited by Elisity.
Key questions
Q: Why do stolen credentials make ransomware outbreaks harder to contain?
A: Stolen credentials matter because they turn the attacker into a valid user, which often bypasses basic trust checks.
Q: How do security teams know if lateral movement defences are actually working?
A: Teams should test whether one compromised identity can reach adjacent systems, SaaS apps, or production zones that it should not access.
Q: What breaks when ransomware attackers get valid credentials instead of exploiting a vulnerability?
A: When attackers authenticate with stolen credentials, perimeter controls lose most of their value because the session looks legitimate.
Practitioner guidance
- Tighten privileged protocol reach Limit RDP, SMB, WMI, PsExec, and remote access tools to designated jump hosts and management networks.
- Segment recovery and management planes Separate backup infrastructure, virtualization management, and operational technology from standard user traffic so a compromised workstation cannot pivot into recovery systems or production control paths.
- Reduce reusable credential reach Apply just-in-time privilege for high-value administrative access and rotate credentials immediately after suspected compromise, especially for accounts that can touch multiple hosts or sites.
Bottom line: Ransomware operators convert one compromised endpoint into broad disruption by combining credential reuse, trusted admin protocols, and weak east-west controls.
Glossary terms: Lateral Movement, Blast Radius, Identity-based Microsegmentation, Standing Privilege
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 hours ago by NHI Mgmt Group
11/07/2026 2:10 pm
Lateral movement is the blast-radius control point, not an endpoint afterthought. The article shows that ransomware operators already understand internal trust boundaries better than many defenders do. Once an attacker can reuse legitimate access inside the estate, perimeter detection no longer defines containment. The practical conclusion is that east-west reach must be governed as tightly as north-south access.
A few things that frame the scale:
- Half of 1,100 global security leaders surveyed by CrowdStrike believed they were very well prepared for ransomware, yet 78% of their organisations had been attacked in the past year.
A question worth separating out:
Q: What should organisations do when administrative tools are being abused for lateral movement?
A: Reduce where those tools can operate, tie them to designated management paths, and monitor them as privileged activity. RDP, SMB, WMI, PsExec, and remote access software should never be broadly available across the internal network.
👉 Read our full editorial: Lateral movement in ransomware is the real blast-radius problem