With Australian and international authorities calling out lateral movement incidents multiple times this year, it’s clearly an area where improvements are being urgently sought. A key trend to gain momentum this year was the issuance of multi-country-led advisories outlining the tradecraft of threat groups striking both Australian and allied targets. Two of these - the living off the land (LOTL) advisory of February, and the analysis of Australian organisations breached by APT40 - dealt with the issue of lateral movement, a post-exploitation activity during which a threat actor tries to compromise adjacent IT systems. The interest in LOTL techniques was driven by their use by “state-sponsored APT ...