BadSuccessor

BadSuccessor is abuse of Active Directory delegated Managed Service Account (dMSA) migration links. Before Microsoft's patch for CVE-2025-53779, a one-sided link could cause a Windows Server 2025 domain controller to treat a controlled dMSA as successor to another account, granting the dMSA the target's effective access and returning target Kerberos key material in the dMSA key package. Microsoft patched that direct escalation path. Akamai's post-patch analysis reports that related credential or privilege abuse can still matter when an actor controls both the target principal and dMSA and can establish the mutual relationship expected by migration. The key package is not universally an NT hash; returned key types depend on the target account's encryption types. Internet-positioned use is possible only if the domain controller's LDAP endpoint is exposed and reachable; an authenticated domain principal with the relevant dMSA creation or write rights is still required.