Loading story…
Multiple security research teams reported DNS-related abuse paths that can be weaponized for denial-of-service and authentication relay. Unit 42 described how Azure Private Endpoint/Private Link DNS behavior can be leveraged—accidentally or maliciously—to disrupt access to Azure resources by effectively “over-privatizing” name resolution, creating a DoS condition for services such as Storage Accounts, Key Vault, Cosmos DB, Azure Container Registry, Function Apps, and OpenAI accounts. Their assessment suggested the exposure is not rare in the wild (they observed 5%+ of Azure storage accounts in configurations susceptible to this DoS pattern) and noted Microsoft guidance around internet fallback as a partial mitigation, alongside recommendations to scan environments for susceptible configurations.
Separately, Cymulate detailed a Kerberos authentication relay technique via DNS CNAME abuse in Windows/Active Directory environments: an on-path attacker can influence DNS CNAME resolution so Windows clients request Kerberos service tickets for attacker-chosen SPNs, enabling relays to services like SMB/HTTP when signing or Channel Binding Tokens (CBT) are not enforced. Cymulate stated Microsoft acknowledged the behavior and responded by improving target-service resilience, including backported CBT support for HTTP.sys in supported Windows Server versions (released in a January patch cycle). A third report from Positive Technologies analyzed an RCE path in Windows Telephony Service (TAPI) via arbitrary file write from a low-privileged client, which is a distinct Windows local/service exploitation topic and not part of the DNS/Kerberos abuse story.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Cymulate publicly detailed a Kerberos authentication relay technique that abuses DNS CNAME responses to coerce victims into requesting service tickets for attacker-chosen SPNs. The write-up showed how this can enable user impersonation, lateral movement, privilege escalation, and possible RCE against services lacking signing or CBT protections.
Palo Alto Networks Unit 42 reported a denial-of-service condition in Azure where linking a Private DNS zone to a virtual network can force name resolution through that zone and break connectivity if required records are missing. The issue can be triggered accidentally by administrators or vendors, or intentionally by an attacker with Azure access, and may affect services including Storage, Key Vault, Cosmos DB, ACR, Function Apps, and OpenAI accounts.
In January 2026 security updates, Microsoft added and backported Channel Binding Token support for HTTP.sys across supported Windows Server versions, tracked as CVE-2026-20929. This reduced exposure to HTTP-based Kerberos relay scenarios stemming from the CNAME abuse technique.
Cymulate Research Labs reported to Microsoft that Windows Kerberos clients follow DNS CNAMEs when constructing SPNs during TGS requests, enabling a relay technique if an attacker can tamper with DNS responses. Microsoft confirmed the behavior and opted to address exposure mainly through service-layer protections rather than changing the underlying client behavior.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two separate Windows authentication weaknesses were highlighted as enabling high-impact **Active Directory** compromise via relay-style attacks. One issue, **CVE-2025-33073**, affects Windows **SMB client** authentication and enables **NTLM reflection**: attackers can coerce `lsass.exe` (running as **SYSTEM**) to authenticate to attacker-controlled infrastructure using techniques such as *PetitPotam*, *DFSCoerce*, and *Printerbug*, then relay/reflect that authentication to gain SYSTEM-level access and potentially full domain compromise. Reporting emphasized that despite a June 2025 patch, the condition remains widely present in enterprise environments due to incomplete patch adoption, and exploitation can be enabled with relatively low prerequisites such as the ability to register a malicious AD DNS record (often permitted to Authenticated Users by default) or to perform local DNS poisoning. A second technique described a **Kerberos relay** vector that abuses how Windows clients process **DNS CNAME** responses when building the SPN for TGS requests, allowing an on-path attacker (e.g., via ARP poisoning or DHCPv6/mitm6) to redirect victims to attacker-controlled services and obtain service tickets usable for relays and lateral movement. The write-up claims default configurations across Windows 10/11 and Windows Server 2022/2025 are susceptible, with potential impact including cross-protocol relays (e.g., HTTP→SMB/LDAP) and paths to RCE in some environments (e.g., via ADCS web enrollment scenarios). A separate Metasploit weekly wrap-up noted new and updated offensive modules (including AD privilege-escalation content), but it did not specifically tie to either of the two relay issues above.
Jun 30, 2026
Microsoft has published a cluster of DNS-related security advisories covering **remote code execution, denial of service, cache poisoning, heap overflow, and access-control bypass** conditions across Windows DNS Server and third-party DNS components. The newly listed issues include `CVE-2026-33278` for possible arbitrary code execution during **DNSSEC** validation, `CVE-2026-42959` for crashes triggered by malicious DNSSEC content, `CVE-2026-42960` for possible cache poisoning through promiscuous authority-section records, and `CVE-2026-42944` for a heap overflow involving multiple `NSID`, `COOKIE`, and `PADDING` **EDNS** options. Additional advisories describe degradation-of-service conditions tied to long EDNS option lists (`CVE-2026-41292`), unbounded name compression (`CVE-2026-44390`), and a "packet of death" affecting **DNSCrypt** (`CVE-2026-32792`). The disclosures also reference flaws in widely used DNS software, including a **BIND 9** resolver unbounded resend loop (`CVE-2026-5950`), invalid handling of `CLASS != IN` (`CVE-2026-5946`), and a **CoreDNS** ACL bypass (`CVE-2026-26017`). Earlier Microsoft advisories for Windows DNS Server remote code execution, including `CVE-2021-33754` and `CVE-2021-33746`, show that DNS services remain a recurring high-impact target because they are network-exposed and central to enterprise operations. For defenders, the combined set of advisories highlights the need to prioritize patching DNS infrastructure, review exposure of DNSSEC, EDNS, and DNSCrypt features, and monitor for service instability or anomalous DNS responses that could indicate exploitation attempts.
Jun 29, 2026
Multiple reports describe ways attackers or testers can **abuse trusted enterprise features** to evade controls. Researchers reported that *Palo Alto Networks Cortex XDR* **Live Terminal** can be repurposed as a stealthy **command-and-control (C2)** channel because its WebSocket-based protocol lacks command signing; an attacker who can intercept the initial WebSocket message can redirect an endpoint to an attacker-controlled server/tenant, leveraging the trusted `cortex-xdr-payload.exe` component to execute commands in a “living off the land” manner. Separately, a tutorial showed *Microsoft Defender for Cloud Apps* (reverse-proxy `*.mcas.ms`) download restrictions for unmanaged devices can be **bypassed by spoofing specific browser user-agent strings**, allowing direct access to services like Outlook/SharePoint and enabling successful downloads that would otherwise be blocked. Other material in the set covers adjacent but distinct execution and delivery risks rather than the same product-specific bypasses. **CVE-2026-27615** affects *ADB-Explorer* on Windows: allowing `ManualAdbPath` to be set to a **UNC path** in a settings file can lead to **remote code execution** by pointing the app to an attacker-controlled network share, fixed in Beta `0.9.26022`. Cofense also documented ongoing campaigns abusing **Windows File Explorer WebDAV** handling to deliver malware without a browser download flow, including use of `trycloudflare[.]com` tunnels to host WebDAV servers and multi-stage script chains to deliver RATs—highlighting a persistent social-engineering and delivery vector that can bypass some browser-centric controls.
Jun 29, 2026