TACTIC: LATERAL MOVEMENT
Lateral Tool Transfer (T1570): Real Cases
MITRE Definition ↗ Adversaries copy binaries, scripts, and utilities from one internal host to another.
Key Facts
Technique ID
T1570
Lateral Movement
Mapped Cases
1
Primary sources
Related Laws
1
Criminal statutes
- ATT&CK Technique Identifier: T1570.
- Tactical Phase: Lateral Movement.
- Substantiated in 1 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (1)
Volt Typhoon Critical Infrastructure Pre-Positioning
alleged 2023-05-24
State-sponsored cyber group sponsored by the People's Republic of China breached dozens of U.S. critical infrastructure operators in communications, energy, transportation, and water systems to establish disruptive persistent access.
Primary Source Evidence Excerpt: CISA Advisory AA24-038A ¶ 25
"Adversaries copied living-off-the-land scripts across internal shares using administrative SMB channels."
Federal Law Enforcement Action / FISA Court Authorized Operations · CISA-AA24-038A
View full case dossier →