Kerberos Coercion via DNS Object SPN Spoofing
Adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and inject marshaled CREDENTIAL_TARGET_INFORMATION structures into DNS queries to coerce authentication from victim systems to attacker-controlled hosts.
CVE search metadata
CVE search record: CVE-2025-33073. Severity: high. CVSS: 8.8. EPSS: 82.83%. KEV: no. Product: Windows 10 1507, Windows 10 1607, Windows 10 1809, Windows 10 21h2, Windows 10 22h2, Windows 11 22h2, Windows 11 23h2, Windows 11 24h2 +7 more. Brief: Kerberos Coercion via DNS Object SPN Spoofing. Brief link: https://feed.craftedsignal.io/briefs/2026-11-dns-kerberos-coercion/
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- High
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 10, 02:45 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Attackers perform Kerberos coercion by manipulating DNS objects to spoof Service Principal Names (SPNs). This technique involves the use of DNS queries containing the pattern "1UWhRCAAAAA..BAAAA," which corresponds to a base64-encoded marshaled CREDENTIAL_TARGET_INFORMATION structure. This activity is associated with Kerberos coercion attacks, including those related to CVE-2025-33073.