Lateral movement occurs when an attacker attempts to move from one system, account, or environment to another within a network or infrastructure after initial access. Attempting to access another isolated cloud subscription by abusing a compromised user role indicates the attacker is trying to move between environments within the cloud infrastructure. This behavior aligns with lateral movement in the MITRE ATT&CK framework.