Stepping Stone Attack

How stepping stone attacks work

A stepping stone attack turns one already-compromised system into a relay point. Rather than connecting directly from the attacker’s own infrastructure, the intruder pivots through intermediate hosts to reach later targets, which obscures origin, spreads activity across multiple systems, and makes attribution and containment more difficult.

The technique is not a single exploit method so much as an attack path. It usually depends on some initial foothold, then uses that foothold to open new remote sessions, move laterally, or proxy traffic onward. That chain is what gives the attack its name: each compromised host becomes another stone across the network.

Why defenders care about lateral movement

Stepping stone attacks matter because they convert one breach into a routing problem for the defender. If the same account, host, or remote access path can be reused to reach other systems, the attacker can blend into normal administration patterns while extending access beyond the original compromise.

For defenders, the practical signal is often not the first intrusion but the follow-on behavior: unusual remote logins, unexpected east-west connections, and outbound traffic that does not match the compromised system’s normal role. A useful reference point for these attack paths is the MITRE ATT&CK Enterprise Matrix, which maps lateral movement and related adversary techniques.

How organisations identify exposure

Exposure checking starts with knowing which systems can talk to which others, and under what credentials. Asset inventory, segmentation maps, remote administration paths, and egress rules all matter because a stepping stone attack depends on an allowed path that can be abused after compromise.

Internet-facing hosts, remote access gateways, admin jump paths, and any system with broad internal reach deserve particular attention. Threat advisories also help prioritise which compromises are most likely to be used as launch points, which is why many teams keep CISA cyber threat advisories close to their monitoring and triage workflows.

Containment, detection, and recovery

Containment is usually about cutting off the relay. That means isolating the compromised host, restricting outbound connections, and reviewing any credentials, sessions, or keys that may have been used to pivot. Where an attacker has chained through multiple machines, responders should assume the first observed host may not be the true entry point.

Detection is strongest when logs are correlated across hosts, identity systems, and network telemetry. Look for repeated login patterns from an unusual source, admin activity outside normal working hours, and session chains that do not match business use. If compromise is confirmed, review the downstream systems the stepping stone could have reached, not just the system that was first detected.

Practitioner Guidance

Why practitioners should care: Stepping stone attacks are a reminder that one compromised endpoint can become a control-bypassing transit point. Defenders should think in terms of reachable paths, not just isolated hosts, because containment fails when the attacker can keep moving through trusted internal routes.

What to watch for: Focus on unusual remote session chains, privileged connections that originate from non-admin systems, and outbound destinations that a compromised host should never need. Those patterns often reveal pivoting earlier than a single alert on the original compromise.

Practitioner takeaway: The most effective defence is to reduce the number of usable stepping stones in the first place, then make lateral movement noisy enough to detect quickly.

Related resources from NHI Mgmt Group

• Why does Agentic AI make NHI attack surface expand so significantly?
• What is the difference between attack surface management and NHI governance?
• Why do NHIs create a larger attack surface than human users?
• Why do static scanners miss some cloud-native attack paths?