How Attackers Move Through Hybrid Networks After the Initial Breach by Lucie Cardiet

## Executive summary This document explains how attackers expand control inside hybrid environments through lateral movement—covering reconnaissance, credential theft, remote execution (PsExec, RDP, SMB), and pivoting using tools like BloodHound, Mimikatz, Cobalt Strike and Brute Ratel. It emphasizes that lateral movement often mimics legitimate administrative activity, challenges traditional perimeter and endpoint defenses, and recommends detection based on correlating identity and network behavior (highlighting the Vectra AI platform).