Full Report
Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, disclose victim IP addresses and mapped ports, and exhaust NAT tables. Presented at Black Hat USA 2026, Stagg said the techniques were demonstrated across network infrastructure devices
Analysis Summary
This summary covers the "NatJack" attack class as disclosed by researcher Malcolm Stagg, based on the provided article.
# Tool/Technique: NatJack
## Overview
NatJack is a class of network attacks that exploits vulnerabilities in Network Address Translation (NAT) connection state management. It allows an attacker sharing the same NAT infrastructure as a victim (such as in cloud, container, or virtualization environments) to manipulate connection-tracking entries. This can result in session hijacking, DNS spoofing, and denial of service.
## Technical Details
- **Type:** Attack Technique / Vulnerability Class
- **Platform:** Windows (Hyper-V NAT), Linux (Netfilter conntrack), macOS (virtualization), and various network infrastructure devices.
- **Capabilities:** TCP session hijacking, DNS hijacking, IP/port disclosure, and NAT table exhaustion.
- **First Seen:** Publicly disclosed at Black Hat USA 2026 (August 2026).
## MITRE ATT&CK Mapping
- **[TA0006 - Credential Access]**
- **[T1557 - Adversary-in-the-Middle]**
- **[TA0008 - Lateral Movement]**
- **[T1563 - Remote Service Session Hijacking]**
- **[TA0040 - Impact]**
- **[T1498 - Network Denial of Service]**
- **[T1499 - Endpoint Denial of Service]** (NAT Table Exhaustion)
## Functionality
### Core Capabilities
- **UDP DNS Hijacking:** The attacker fills the NAT table with dummy entries to evict a victim's legitimate pending DNS request. They then create replacement entries to redirect the DNS response to the attacker, allowing them to send a spoofed response to the victim.
- **TCP/IP Hijacking:** Two variants (upstream and downstream) involve removing and replacing a victim's NAT entry to take control of an active TCP session.
- **Victim IP/Port Disclosure:** Manipulating NAT state to reveal the internal IP addresses and mapped ports of other systems behind the same NAT.
### Advanced Features
- **Cross-Subnet Hijacking:** The "upstream" TCP variant allows an attacker to hijack connections even if the victim is in a different subnet or broadcast domain, provided they share the same NAT gateway.
- **State Manipulation:** Exploiting logic errors in how NAT handles specific packet sequences (e.g., invalid SYN/RST sequences) to prematurely close or modify connection-tracking entries.
## Indicators of Compromise
- **File Hashes:** N/A (Technique-based, though 7 PoC variants were developed for research).
- **Network Indicators:**
- Unusually high volume of NAT table entries from a single internal host.
- Unexpected TCP RST (Reset) packets with invalid sequence numbers.
- DNS responses originating from unexpected internal MAC/IP addresses.
- **Behavioral Indicators:** Frequent eviction of legitimate NAT sessions; inconsistent network connectivity for neighboring VMs or containers.
## Associated Threat Actors
- No public evidence of exploitation in the wild by specific threat actors was reported as of August 2026.
## Detection Methods
- **Behavioral Detection:** Monitoring NAT gateways for "NAT Table Exhaustion" events or rapid state changes for active sessions.
- **Signature-Based:** Identifying the specific packet sequences used to trigger CVE-2026-63913 (crafted SYN followed by an invalid RST).
- **Network Telemetry:** Analyzing flow logs for session hijacking patterns where a session's destination or source attributes change abruptly mid-stream.
## Mitigation Strategies
- **Network Segmentation:** Separate untrusted workloads (e.g., guest VMs or containers) from trusted systems, ensuring they do not share the same NAT infrastructure.
- **Patching:**
- Update Windows 11/Server 2025 to address **CVE-2026-56181**.
- Update Linux Kernels to fixed versions (e.g., 6.12.93+, 7.1+) to address **CVE-2026-63913**.
- **Encryption:** Use end-to-end encryption (TLS, SSH, IPsec) for all traffic, even within internal networks, to prevent data disclosure during hijacking.
- **Security Features:** Implement IP Source Guard where supported by network hardware.
## Related Tools/Techniques
- **SnailLoad:** Earlier research regarding NAT-state manipulation.
- **DNS Cache Poisoning:** Related impact, though NatJack achieves it via NAT state manipulation rather than protocol-level racing.