Impacket (fortra)

New Capabilities

Reviewing PR #2324 adding U2U support; maintainers requested changes on October 28, 2026, and the author added the checks by October 30

A new Kerberos attack can take an attacker from one compromised account to full control of a domain, even when the target account has no service principal name (SPN, the identifier Kerberos uses for services). Sprocket Security's Hunter Wade published the technique in October 2026, combining two known methods: reflective resource-based constrained delegation and user-to-user authentication. In the proof of concept, the chain reached domain administrator and extracted credentials from a domain controller.

Updated Nov 1