There are three main stages of a lateral movement attack. Reconnaissance - In this stage, threat actors explore the network to find out weaknesses in the node, network, and applications to compromise endpoint security. Credential dumping or privilege gathering - Here, attackers try to intrude into a network by obtaining login credentials through phishing and other social engineering techniques. Gaining access to other systems in the organization's network - Adversaries propagate into the network until the target machine is reached, then they carry out an actual attack by exfiltration of sensitive information.