After breaking in, what do "lateral movement", "command & control", and "internal reconnaissance" mean in the attack chain?
Lateral movement = spreading to more systems; C2 = the attacker's remote-control channel; internal recon = mapping the network from inside.
* The ransomware kill chain — the gap between initial compromise and encryption is the defender's detection window. *
Once inside, the attacker doesn't immediately detonate ransomware. They work methodically:
- Command & Control (C2): the compromised host phones home to the attacker's C2 server, giving remote control and a path to download tools.
- Internal reconnaissance: map the internal network — find domain controllers, file servers, the backup server, where the valuable data lives.
- Lateral movement: use stolen credentials/exploits to hop from the first foothold to more systems (especially toward the datacenter and domain controllers).
Why this "dwell time" matters: the gap between intrusion and encryption is the defender's opportunity — detect the C2 traffic or the recon/lateral movement and you can stop the attack before the ransomware fires. This is the whole rationale for EDR and network monitoring.
Tip: Attackers specifically hunt the backup system during recon — destroying or encrypting backups first is what forces victims to pay.
Go deeper:
Lateral movement (Wikipedia) — the techniques attackers use to move through a network toward key assets after gaining a foothold.- Advanced persistent threat (Wikipedia) — the staged intrusion lifecycle — foothold, recon, lateral movement, exfiltration — and long dwell times.