Loading story…
Security researcher Malcolm Stagg disclosed NatJack, a new attack class that abuses Network Address Translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, reveal mapped ports, and exhaust NAT tables on affected infrastructure devices. The research, presented at Black Hat USA 2026 and detailed at natjack.io, describes weaknesses observed across multiple independently developed NAT implementations rather than a single vendor-specific flaw.
Implementation-specific issues have been tracked as CVE-2026-56181 for Windows NAT for Hyper-V and CVE-2026-63913 for Linux Netfilter conntrack. The attack generally requires privileged access to a host behind the same NAT as the victim, making shared NAT environments a key risk area. Recommended mitigations include separating trusted and untrusted workloads that share NAT infrastructure, applying available Windows and Linux patches, encrypting internal traffic, and using IP Source Guard where possible; no single patch addresses the broader NatJack attack class, and there was no public evidence of in-the-wild exploitation at the time of disclosure.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Security researcher Malcolm Stagg disclosed a new attack class called NatJack and presented the research at Black Hat USA 2026. The work showed that manipulating NAT connection state can enable TCP session hijacking, DNS spoofing, mapped-port disclosure, and NAT table exhaustion across multiple NAT implementations.
An implementation-specific NatJack-related issue in Linux Netfilter conntrack was tracked as CVE-2026-63913. The kernel.org CNA record said crafted packets could prematurely force an active NAT entry into a closed state because the conntrack logic failed to validate packet direction.
An implementation-specific NatJack-related issue in Windows NAT for Hyper-V was tracked as CVE-2026-56181. Microsoft's CNA record described it as an origin-validation error that could enable spoofing from an adjacent network.
Fixed Linux stable releases for CVE-2026-63913 were made available, including versions 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1. Stagg said the kernel fix corrects the code flaw but only raises the complexity of the broader downstream-spoofing technique.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourcenatjack.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nokia Deepfield researchers reported that the **Jackskid** DDoS botnet, the **peer4you-mirai** hybrid malware, and the **trees4sale** residential proxy service are linked to a single operator that abuses **UPnP Internet Gateway Device** port mapping to expose infected residential devices directly to the internet. Instead of routing traffic through outbound tunnels, the malware opens about **165 external router ports** marked **"RELAY"**, converting compromised home devices into proxy exits. The report ties the operations together through shared relay code, a byte-identical `RCtea` configuration key, overlapping infrastructure, and cryptocurrency wallets funded by the same upstream source. The research says **peer4you-mirai** connects the DDoS and proxy activity, while newer Jackskid variants either deploy the relay as a second Android payload or embed it directly into Linux bot binaries. In addition to DDoS and proxy services, the operator reportedly uses compromised residential devices as a rotating **C2 relay mesh** populated from a `/nodes` director. The technique builds on the long-observed **UPnProxy** abuse pattern, but the newer campaign operationalizes it at scale for botnet control and commercial proxying. Defenders were urged to watch for **SSDP discovery**, SOAP `AddPortMapping` requests, and NAT entries whose description is **"RELAY"**, which the researchers described as strong indicators of compromise.
Aug 14, 2026
Attackers widely exploited **CVE-2023-4966** (`Citrix Bleed`), a critical flaw in **NetScaler ADC** and **NetScaler Gateway** that can leak sensitive information, including session authentication tokens, and enable authentication bypass or session hijacking on affected Gateway or AAA virtual servers. Citrix issued a critical security update and later published investigation recommendations, while defenders reported attack activity beginning in late October and rising sharply through November. One observed technique targeted `/oauth/idp/.well-known/openid-configuration` with an unusually long `Host` header to steal session cookies, and a large share of detected attack traffic was traced to infrastructure in Germany, followed by Russia, China, Japan, and the United States. The vulnerability was later tied to real-world intrusions, including a **PLAY ransomware** compromise of a professional services firm. After obtaining access through Citrix Bleed, the attackers performed internal reconnaissance to enumerate domain accounts, trusted domains, permission groups, and remote systems before advancing their operation. Security guidance urged organizations running affected NetScaler products, including unsupported `12.1` versions, to apply fixed releases immediately and investigate for signs of token theft or unauthorized session use.
Aug 15, 2026
A high-severity flaw in **NATS Server** tracked as `CVE-2026-58253` allows unauthenticated peers to bypass authentication on inter-server **route** and **leafnode** listeners when the `no_auth_user` option is enabled. The bug stems from a parser fast path that was meant for ordinary client connections but was incorrectly applied to non-client connection types, allowing an attacker to skip the required `CONNECT` authentication step and inherit the privileges of that server-to-server connection. The issue is rated **CVSS 8.8** and mapped to **CWE-287 Improper Authentication**. Maintainers fixed the problem by restricting `no_auth_user` behavior to **client connections only** and enforcing that route, leafnode, and some gateway connections must begin with `CONNECT` before other protocol messages are accepted. Associated tests show that non-client peers sending `PING` first are now rejected, direct route-protocol message injection such as `RMSG` without `CONNECT` is blocked, and normal client behavior remains unchanged when `no_auth_user` is configured. The vulnerability affects releases before **2.14.0**, **2.12.7**, and **2.11.16**, which contain the fix.
Jul 9, 2026