Loading story…
Huntress disclosed "dMSA Ouroboros," a technique that abuses delegated Managed Service Accounts (dMSAs) in fully patched Windows Server 2025 to create self-sustaining persistence and repeatedly extract credentials. The method chains delegated CreateChild and WriteProperty permissions with object ownership, Shadow Credentials stored in msDS-KeyCredentialLink, and self-referential msDS-GroupMSAMembership entries so a rogue dMSA can authenticate and authorize itself to recover the superseded account's NT hash. The researchers said the approach builds on Akamai's BadSuccessor work and differs from Semperis's Golden dMSA research by focusing on post-creation abuse paths.
According to the report, the attack survives password rotation, can persist even after the original attacker account is deleted, and may prevent Domain Admins from fully remediating the compromise unless the malicious dMSA object itself is removed. Huntress said Microsoft's patch for CVE-2025-53779 did not address this abuse path and that Microsoft classified the issue as a persistence mechanism rather than an elevation-of-privilege flaw, declining to issue a further fix. The firm urged defenders to audit delegated CreateChild rights, monitor dMSA creation by non-admin users, and hunt for suspicious msDS-KeyCredentialLink values and self-SID entries in msDS-GroupMSAMembership on dMSA objects.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Huntress published research describing dMSA Ouroboros, a persistence and credential-extraction technique affecting fully patched Windows Server 2025 environments. The technique uses delegated CreateChild and WriteProperty permissions, object ownership, Shadow Credentials, and self-referential GroupMSAMembership entries to repeatedly recover a superseded account's NT hash.
After reviewing the reported issue, Microsoft classified dMSA Ouroboros as a persistence mechanism rather than an elevation-of-privilege vulnerability and declined to provide a servicing update. This left the described abuse path unpatched according to Huntress.
Akamai published follow-up research examining Microsoft's fix for CVE-2025-53779 and the BadSuccessor technique involving delegated Managed Service Accounts in Windows Server 2025. The analysis described how the original attack worked by linking an attacker-controlled dMSA to a target account so the KDC merged the target's privileges and exposed its Kerberos keys, enabling immediate compromise with control of any OU.
Microsoft issued a fix for CVE-2025-53779 in 2025 to address a dMSA-related issue discussed alongside BadSuccessor research. Huntress later stated the patch did not remediate the post-creation abuse path used in dMSA Ouroboros.
Akamai disclosed the BadSuccessor technique in 2025, showing how delegated Managed Service Accounts could be abused in Active Directory. This prior research established the foundation for later investigation into additional dMSA attack paths.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
huntress.com
Open sourceakamai.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are increasingly leveraging advanced credential theft techniques to compromise Microsoft-based environments, with a focus on identity-first intrusions and abuse of authentication protocols. Kerberoasting attacks have resurged, exploiting legacy RC4 encryption in Kerberos to crack service account passwords, as seen in the Ascension Health ransomware incident. These attacks are facilitated by weak password policies and the continued use of outdated encryption, allowing threat actors to obtain domain administrator credentials and move laterally within networks. The prevalence of credential-based intrusions is underscored by threat intelligence reports indicating that identity attacks are now the leading entry point for breaches. Simultaneously, authentication coercion attacks are evolving, enabling adversaries to force Windows systems to authenticate to attacker-controlled infrastructure without user interaction. Techniques such as exploiting rarely monitored RPC interfaces and tools like PetitPotam (CVE-2021-36942) have been observed in real-world incidents, targeting critical assets like Domain Controllers. Additionally, threat actors are abusing OAuth consent, device code flow, and service principal credential manipulation to maintain persistent, stealthy access to cloud and SaaS platforms, often pivoting from on-premises exploits to Microsoft 365 environments. Organizations are advised to implement robust monitoring, enforce strong authentication policies, and phase out legacy protocols to mitigate these threats.
Jun 29, 2026
Attackers are abusing Microsoft Volume Shadow Copy Service (VSS) to impair recovery ahead of ransomware deployment and to access copied `NTDS.dIT` data containing Active Directory credentials. In a Huntress investigation, PsExec-launched SYSTEM shells on a domain controller were followed by RDP-session enumeration, creation of VSS shadow copies, and an attempted deletion of the newly created copies; endpoint antivirus blocked the deletion attempt. The activity also included DNS enumeration and reconnaissance against another host, supporting an assessment of lateral movement and credential-access operations. VSS creation or deletion alone is not a reliable alert because backup, RMM, and administrative products commonly use the service; defenders should correlate VSS events with process lineage, privileged remote execution, reconnaissance, credential harvesting, and event timing.
Sep 15, 2026
Semperis disclosed two Active Directory privilege-escalation vulnerabilities involving hidden and unfilterable Unicode characters that can undermine Microsoft’s identity protections. The first flaw, **KerberLoss** (`CVE-2026-25177`), lets a low-privileged user with service principal name (SPN) write permissions bypass SPN and SPN-alias uniqueness checks, enabling denial of service against `HOST`-mapped services, SPN-jacking in constrained delegation scenarios, and forced Kerberos-to-NTLM downgrade. The second flaw, **ResetNightmare** (`CVE-2026-27912`), is more severe and allows an attacker who can write a user principal name (UPN) on a user or computer object to abuse NT-ENTERPRISE name handling and the Kerberos password-change protocol to reset a privileged account’s password and gain Domain Admin access. The findings build on Microsoft’s earlier hardening work for `CVE-2021-42282`, which introduced uniqueness verification for UPNs, SPNs, and SPN aliases, but the new research shows those checks could still be bypassed under certain conditions. Microsoft patched **KerberLoss** in March 2026 and **ResetNightmare** in April 2026. Defenders were urged to update domain controllers, restrict delegated rights that allow SPN or UPN modification, and monitor Active Directory changes—particularly suspicious SPN and UPN edits such as **Event ID 5136**—for signs of exploitation.
Aug 6, 2026