Full Report
Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables. Presented at Black Hat USA 2026, the research found affected behavior across independently developed implementations, including Windows and
Analysis Summary
# Tool/Technique: NatJack
## Overview
NatJack is a class of network-based attacks disclosed by security researcher Malcolm Stagg at Black Hat USA 2026. The technique exploits design assumptions in Network Address Translation (NAT) implementations, specifically the assumption that hosts residing behind the same NAT will not attempt to manipulate or interfere with each other's connection states. By manipulating NAT connection-tracking (conntrack) entries, an attacker can hijack sessions, spoof responses, and disrupt connectivity for other devices on the same local network.
## Technical Details
- **Type:** Technique / Attack Class
- **Platform:** Windows (Hyper-V NAT), Linux (Netfilter/conntrack), and various network infrastructure products (routers/firewalls).
- **Capabilities:** TCP session hijacking, DNS spoofing, port mapping exposure, and NAT table exhaustion (DoS).
- **First Seen:** Publicly disclosed August 2026.
## MITRE ATT&CK Mapping
- **[TA0006 - Credential Access]**
- **[T1557 - Adversary-in-the-Middle]**
- **[TA0008 - Lateral Movement]**
- **[T1557.001 - LLMNR/NBT-NS Poisoning and SMB Relay]** (Related behavior via DNS spoofing)
- **[TA0040 - Impact]**
- **[T1498 - Network Denial of Service]**
- **[T1499 - Endpoint Denial of Service]**
## Functionality
### Core Capabilities
- **TCP Session Hijacking:** Redirects traffic from an active TCP connection by replacing the existing NAT mapping with one controlled by the attacker.
- **DNS Spoofing:** Interferes with a victim's DNS request so the legitimate response is diverted to the attacker, allowing the attacker to provide a forged response to the victim.
- **NAT Table Exhaustion:** Floods the NAT connection table with spoofed flows, preventing legitimate users from establishing new outbound connections.
### Advanced Features
- **Cross-Implementation Vulnerability:** Exploits a fundamental logic flaw in how NAT handles "internal" trust, affecting both Windows and Linux kernels independently.
- **State Manipulation:** In Linux specifically (CVE-2026-63913), uses crafted SYN and invalid RESET packets to force active NAT entries into a closed state prematurely.
## Indicators of Compromise
- **File Hashes:** N/A (Technique-based; no specific malware binary associated).
- **File Names:** N/A.
- **Registry Keys:** N/A.
- **Network Indicators:**
- Unexpected DNS responses originating from local/adjacent IP addresses.
- High volumes of SYN/RST packets with invalid sequence numbers (Linux context).
- Rapid exhaustion of NAT gateway resources.
- **Behavioral Indicators:**
- Active TCP sessions suddenly dropping or being redirected to unauthorized endpoints.
- Discrepancies between expected and actual NAT mapping tables on gateways.
## Associated Threat Actors
- As of August 2026, there is no public evidence of NatJack being exploited in the wild by specific threat groups. It is currently categorized as researcher-disclosed proof-of-concept (PoC) material.
## Detection Methods
- **Signature-based detection:** Monitoring for the specific packet sequence (SYN followed by invalid RST) identified in CVE-2026-63913.
- **Behavioral detection:**
- Identifying "Internal-to-Internal" NAT state changes where one local IP attempts to modify the mapping of another.
- Monitoring for unusually high rates of new connection attempts from a single internal host (DoS/Exhaustion).
- **Network Telemetry:** Analyzing NAT table logs for frequent mapping overwrites.
## Mitigation Strategies
- **Patch Management:**
- **Windows:** Update to Windows 11 24H2 (Build 26100.8875+) or Windows Server 2025 (Build 26100.33158+) to address CVE-2026-56181.
- **Linux:** Update to kernel versions 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 7.0.12, or higher to address CVE-2026-63913.
- **Network Segmentation:** Separate untrusted workloads (e.g., guest VMs, containers) from trusted systems, even if they share the same physical infrastructure.
- **Encryption:** Enforce end-to-end encryption (TLS/IPsec) for all internal traffic to prevent session hijacking from resulting in data exposure.
- **IP Source Guard:** Implement IP Source Guard on switches to prevent IP spoofing from adjacent hosts.
## Related Tools/Techniques
- **SnailLoad:** Previous research into NAT-state and timing manipulation.
- **Adjacent-Network Spoofing:** General class of attacks where local trust is exploited.
- **DNS Cache Poisoning:** Related goal achieved via different network layer manipulation.