Elad Shamir

New Capabilities

Prior research forms half of the new attack

A new Kerberos attack can take an attacker from one compromised account to full control of a domain, even when the target account has no service principal name (SPN, the identifier Kerberos uses for services). Sprocket Security's Hunter Wade published the technique in October 2026, combining two known methods: reflective resource-based constrained delegation and user-to-user authentication. In the proof of concept, the chain reached domain administrator and extracted credentials from a domain controller.

Updated Nov 1