What is lateral movement in cybersecurity?
Lateral movement is how an attacker spreads from the first compromised machine to others, typically with stolen credentials over remote services such as SMB, RDP, SSH or WinRM. MITRE ATT&CK lists it as tactic TA0008; Remote Services is technique T1021.
This answer also appears, with more context, here: Lateral movement and C2 beaconing