New Kerberos attack abuses constrained delegation on SPN-less accounts

Overview

Updated 2 hours ago

A new Kerberos attack gives attackers a path from a single compromised account to full domain control, even when the target account has no service principal name (SPN) registered. Researchers at Sprocket Security published the technique on September 21, 2026, showing how constrained delegation can be abused in a case long considered impossible.

The attack chains two known methods: reflective resource-based constrained delegation and user-to-user authentication. A proof of concept escalated to domain administrator and extracted all credentials from the target domain controller.

Why it matters

If domains keep RC4 encryption enabled and machine account quotas open, this hands attackers a new route to domain admin from any compromised account.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

Code changes to Impacket getST.py

Four modifications enable S4U2Proxy with U2U against SPN-less accounts.

100%

ESSGroup confidence rating

Independent analysis rated the disclosure 100 percent confident and fully reliable.

Steps in the attack chain

From initial ticket request to full domain compromise in the proof of concept.

Voices

Curated perspectives — historical figures and your fellow readers.

People Involved

Sprocket Security researcher (elohhs)

Disclosing security researcher

Published the technique and submitted tooling support

Elad Shamir

Security researcher

Prior research forms half of the new attack

James Forshaw

Security researcher, Google Project Zero

Developed the U2U sacrificial user technique

Tudor Iancu

Security researcher, ESSGroup

Published independent analysis of the disclosure

Organizations Involved

Sprocket Security

Penetration testing firm

Disclosed the Kerberos delegation attack

Firm whose researcher discovered and publicly disclosed the constrained delegation abuse path.

Impacket (fortra)

Open-source security tooling project

Received pull request adding U2U support for the technique

Python toolkit for Kerberos and Active Directory attacks; maintainers hold the pull request enabling the new technique.

Timeline

September 2026 October 2026

4 events Latest: Yesterday

Tap a bar to jump to that date

October 2026
Technique surfaces on Hacker News
Latest Publication

Hacker News post shares the September disclosure with a wider security audience.
Yesterday
September 2026
Sprocket Security disclosure recognized
Disclosure

The constrained delegation abuse path is publicly disclosed by Sprocket Security, per ESSGroup analysis.
September 22nd, 2026
Blog reveals Kerberos delegation attack
Disclosure

Sprocket Security publishes the technique on hun.io, combining reflective RBCD with U2U against SPN-less accounts.
September 21st, 2026
Impacket pull request adds U2U support
Development

PR #2324 submitted to fortra/impacket adding S4U2Proxy+U2U support needed for the technique.
September 2026

Scenarios

Impacket merges U2U support for the new attack

Likely Resolves by Q1 2027

Discussed by: Fortra Impacket maintainers and the offensive security tooling community

Pull request 2324, adding S4U2Proxy+U2U support to getST.py, clears review and merges into the main branch. That makes the technique a one-command operation in the standard toolkit, lowering the barrier for red teams and attackers alike.

Microsoft publishes hardening guidance for SPN-less delegation abuse

Possible Resolves by Q2 2027

Discussed by: Enterprise Active Directory administrators and Microsoft security teams

Microsoft's security response team issues an advisory or documentation update covering constrained delegation abuse in SPN-less accounts. Likely recommendations mirror published guidance: disable RC4, restrict machine account quota, and monitor the msDS-AllowedToActOnBehalfOfOtherIdentity attribute.

First real-world exploitation of the delegation technique reported

Possible Resolves by Q2 2027

Discussed by: Incident response firms tracking Kerberos-based intrusions

A public case report from a major incident response firm documents an intrusion using this technique to reach domain admin. This would confirm that the attack has moved from research into criminal tooling.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

2021

Wagging the Dog (2021)

Security researcher Elad Shamir published 'Wagging the Dog,' showing how attackers could abuse resource-based constrained delegation when they control a computer with an SPN. He demonstrated chaining S4U2Self and S4U2Proxy to obtain forwardable tickets for any user.

Then

RBCD abuse became a standard Active Directory attack, with tools like Impacket adding automated modules.

Now

It established reflective RBCD, the first half of the new technique targeting SPN-less accounts.

Why this matters now

The new attack adapts Shamir's reflective RBCD chain to work without any SPN.

2014

Kerberoasting (2014)

At the DerbyCon security conference, researcher Tim Medin showed that any domain user could request Kerberos service tickets and crack service account passwords offline. The requests never trigger account lockout.

Then

Kerberoasting became a headline Active Directory attack, pushing defenders toward long random service account passwords and AES-only encryption.

Now

It established the pattern of abusing legitimate Kerberos features against operational assumptions, which the new delegation attack follows.

Why this matters now

Both attacks use Kerberos's own functions to defeat assumptions about which domain accounts are safe.

2020s

U2U sacrificial user technique (2020s)

Google Project Zero researcher James Forshaw developed a method pairing user-to-user authentication with Kerberos delegation to obtain forwardable tickets. The approach uses a sacrificial account whose session key serves as the ticket encryption key.

Then

The technique fed into Impacket and further research on delegation abuse paths.

Now

It supplied the second half of the new attack: user-to-user authentication against an SPN-less account.

Why this matters now

The new technique is the direct combination of Shamir's reflective RBCD and Forshaw's U2U method.