Benjamin Delpy
- Created mimikatz in 2011, demonstrating how Windows stored credentials in memory
- Documented Kerberos ticket attacks including golden and silver tickets
- Maintains the tool against each generation of Windows credential defenses
Bio
Benjamin Delpy, who publishes as gentilkiwi, wrote mimikatz in 2011 after finding that Windows held both an encrypted copy of a password and the key to decrypt it in memory at the same time. Microsoft's initial response was that exploiting it required an already-compromised machine. He published the tool, and the industry's understanding of credential theft changed.
Profile built from public project, vendor, and press records. Included as a researcher whose published work reshaped defensive practice; this is not an endorsement of any use of the tool.
Where their work shows up
Almost every defensive control now considered standard in a Windows environment exists because mimikatz made the attack undeniable: Credential Guard, LSA protection, tiered administration, disabling WDigest, and the whole practice of treating a domain controller as a crown jewel. It also made Kerberoasting, pass-the-hash style credential reuse, and Kerberos delegation abuse teachable rather than theoretical. See the ITDR guide and the best ITDR for Active Directory ranking.
Related on Start with Identity
- BlogA FreeIPA flaw chain let an anonymous client write itself a reusable administrator credential
CVE-2026-76578 (CVSS 9.8) chains with a 389 Directory Server ownership-check bug so an unauthenticated client can create an OTP token entry, pass the ownership
- CVECheckSum, Kerberos S4U missing cryptographic step
The KDC skipped a cryptographic step in PA-S4U-X509-USER (CWE-325). An attacker can forge an identity via S4U2self and escalate to domain compromise. Presented
- GlossaryIdentity Resilience
The ability to keep authenticating and authorising legitimate users, and to recover the identity system itself, when the identity provider or directory is degra
- CVEKerberLoss, invisible-Unicode SPN uniqueness bypass
Active Directory treated look-alike SPNs with invisible Unicode as unique. An attacker can hijack a service name, force NTLM downgrade, and steal credentials. S
- BlogKerberLoss: invisible Unicode lets an attacker twin a Kerberos SPN
CVE-2026-25177, CVSS 8.8. Active Directory treated look-alike SPNs as unique. Semperis and Shai Laron showed how that becomes service hijack and NTLM downgrade.
- CVEResetNightmare, kpasswd bypasses PAC_REQUESTOR_SID
Kerberos Change Password (kpasswd) did not honor PAC_REQUESTOR_SID the way the rest of AD did. A low-privilege user who can write their UPN can reset a Domain A