In February 2024, the ALPHV/BlackCat ransomware affiliate compromised Change Healthcare, triggering historic disruptions across the United States healthcare sector. According to UnitedHealth Group's congressional testimony delivered in May 2024, the attackers logged into a Citrix remote-access portal using compromised credentials. That portal lacked multi-factor authentication. Once inside, the operators moved laterally through the internal network for approximately nine days, exfiltrated sensitive data, and ultimately deployed ransomware.
This incident illustrates an architectural reality familiar to security teams: perimeter failures happen, but lateral movement determines the blast radius. Missing multi-factor authentication opened the door, but flat network architecture and unrestricted internal communication gave the attackers nine days of unimpeded mobility. To prevent similar outcomes, security leaders must analyze the mechanics of enterprise lateral movement and implement architectural boundaries that restrict an intruder to their initial point of compromise.
How do ransomware operators move laterally inside enterprise networks?
Ransomware deployments are rarely smash-and-grab events. Modern threat actors execute deliberate, multi-stage intrusions. By mapping their behavior to the MITRE ATT&CK framework, we can see exactly where conventional enterprise security stacks break down.
1. Initial Access (T1078, T1133)
Attackers establish initial footholds primarily through External Remote Services (T1133) or Valid Accounts (T1078). Stolen credentials purchased on illicit marketplaces or harvested through credential-phishing campaigns allow operators to authenticate to virtual private networks, remote desktop gateways, and access portals without generating brute-force alarms.
2. Discovery (T1087, T1018)
Once connected to a single host or portal, the intruder performs internal reconnaissance. They query Active Directory using built-in command-line tools like net.exe, nltest.exe, and PowerShell to map domain trusts, locate domain controllers, identify file servers, and inventory active sessions across the subnet.
3. Credential Access (T1003)
To expand access, operators dump credentials from memory and local storage via OS Credential Dumping (T1003). They extract cached NTLM hashes, Kerberos tickets, and plaintext passwords from the Local Security Authority Subsystem Service (LSASS) process. In unsegmented environments, compromise of a single workstation often yields local administrator credentials reused across hundreds of other endpoints.
4. Lateral Movement (T1021, T1550)
Equipped with valid internal credentials or password hashes, the attacker pivots across the network using Remote Services (T1021). They leverage administrative protocols that firewalls routinely leave open internally: Server Message Block (SMB/RPC port 445), Remote Desktop Protocol (RDP port 3389), and Windows Remote Management (WinRM port 5985/5986). Using tools like PsExec or WMI, alongside Pass the Hash (T1550.002), they execute commands on adjacent servers without introducing malware.
5. Exfiltration and Impact (T1041, T1486)
Before executing encryption routines, attackers stage high-value business data and exfiltrate it over encrypted channels to public cloud storage providers. Only after securing extortion leverage do they deploy Data Encrypted for Impact (T1486), orchestrating domain-wide encryption via Group Policy Objects (GPO) or administrative scripts targeted at hypervisors and storage arrays.
What is the structural flaw in modern enterprise networks?
Most enterprise security programs operate under a hardened-perimeter model. Organizations invest heavily in firewalls, secure web gateways, and intrusion prevention systems at network edges. Yet once a packet traverses the edge, the internal topology resembles an open plain.
Every workstation can initiate connections to every other workstation on ports 445, 135, and 3389. Database servers reside in subnets where routine administrative ports remain continuously open to IT management segments and jump hosts. When an adversary acquires administrative credentials, the network fabric itself assists them. The ports required to move from finance to HR, or from engineering to the Active Directory domain controller, are permanently open and listening.
Endpoint Detection and Response (EDR) provides essential visibility, but relying on EDR alone to halt lateral movement creates operational blind spots. Attackers operating via legitimate tools—such as mstsc.exe, PowerShell, and native net commands—blend into the ambient noise of daily systems administration. An administrative login using valid credentials over SMB or RDP does not trigger signature alerts. Stopping lateral movement requires structural controls that prevent the network packet from ever reaching the listening socket.
What is the defense blueprint for containment?
Containing ransomware requires closing internal administrative pathways by default. The objective is to ensure that even if an attacker acquires domain administrative credentials, they cannot reach target hosts over the network without explicit, real-time authorization.
- Enforce MFA across all external remote access: Eliminate every single-factor ingress point, including legacy VPNs, customer service portals, and out-of-band management interfaces.
- Implement default-deny micro-segmentation: Block workstation-to-workstation traffic entirely. Restrict workstation-to-server traffic to strictly documented application ports, shutting down lateral SMB, RPC, and RDP access across internal subnets.
- Deploy just-in-time, MFA-gated network access: Administrative ports (22, 3389, 445, 5985) should remain closed by default at the network layer. Require engineers to pass a step-up MFA challenge that opens the specific port only for the duration of the active administrative session.
- Isolate service accounts and Tier-0 assets: Strip domain administrator accounts of interactive logon privileges on workstations. Confine domain controller management strictly to dedicated, isolated administrative consoles that cannot reach the open internet.
- Harden credential storage: Enable Windows Defender Credential Guard to isolate LSASS in a virtualization-based security container, preventing memory dumping even by processes running with local SYSTEM privileges.
How to execute a 30-day ransomware containment plan
Network micro-segmentation historically stalled due to operational complexity and the fear of breaking business applications. Security teams can achieve rapid, high-impact containment by focusing exclusively on lateral movement pathways through an orderly 30-day plan.
- Days 1-7: Audit external attack surfaces and inventory internal admin traffic. Review all external-facing portals to confirm strict MFA enforcement. Deploy network sensors or non-intrusive monitoring to map legitimate internal RDP, SMB, and WinRM baselines.
- Days 8-14: Sever workstation-to-workstation communication. Workstations virtually never need to communicate directly with other workstations. Implement host firewall or network-layer rules blocking all inbound client-to-client traffic, instantly neutralizing automated worm-like propagation.
- Days 15-21: Restrict inbound server administration. Silence listening ports 135, 445, and 3389 on critical servers. Route administrative access through designated jump hosts or enforce dynamic, identity-verified network access policies.
- Days 22-30: Enforce step-up MFA on sensitive administrative pathways. Gate critical lateral hops—such as connecting to hypervisor consoles, backup repositories, and domain controllers—behind just-in-time network access requiring multi-factor authentication.
While lateral movement determines the scale of the damage, organizations must also eliminate the entry points attackers exploit to steal initial credentials; implementing comprehensive <a href="/email-protection">email protection for business</a> neutralizes credential-phishing campaigns before credentials ever reach external portals.
How Lion Group helps
Lion Group deploys Zero Networks to solve the lateral movement problem without the operational overhead of traditional segmentation projects. Zero Networks delivers automated micro-segmentation by operating in an intelligent learning mode to map network flows, requiring zero agents to deploy. It places every asset behind a default-deny perimeter, keeping administrative ports invisible and inaccessible until an authorized user requests access via just-in-time, two-factor authentication directly at the network layer—instantly containing ransomware at its initial point of entry.