Security researcher Malcolm Stagg reveals new class of network manipulation attacks
A new class of attacks called NatJack manipulates NAT tables to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables, according to research presented at Black Hat USA 2026.
Malcolm Stagg, a security researcher, disclosed a new attack class named NatJack that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables.
NatJack attacks target the fundamental stateful nature of most NAT implementations, which track active connections to translate private IP addresses to public ones.
By carefully injecting or modifying specific entries in the NAT table, the attacker can redirect traffic destined for a legitimate host to an arbitrary endpoint, effectively taking control of the session.
Once the session is hijacked, the attacker can replay or modify packets, allowing for data exfiltration or injection of malicious payloads without the original endpoint’s knowledge.
In addition to session hijacking, NatJack can generate forged DNS replies that resolve to the attacker’s IP, bypassing standard DNS validation mechanisms and redirecting clients to malicious sites.
The manipulation also reveals which internal ports are mapped, giving attackers insight into the internal network topology and potential lateral movement opportunities.
Because the attack consumes NAT table entries, a prolonged exploitation can lead to a table exhaustion, denying legitimate connections and causing a denial‑of‑service condition for the affected host.
Stagg presented the findings at Black Hat USA 2026, highlighting the breadth of affected implementations, including Windows, Linux, and various commercial routers.
These findings underline the importance of strict NAT table management and the need for intrusion detection systems to monitor anomalous NAT state changes.
Defenders are advised to employ rate limiting on NAT table updates, use secure DNS protocols such as DNS‑SEC, and regularly audit NAT configurations for unexpected entries.
Future work will focus on developing automated detection of NatJack patterns and integrating countermeasures into existing firewall and router firmware.
Malcolm Stagg, a security researcher, disclosed a new attack class named NatJack that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables.
NatJack attacks target the fundamental stateful nature of most NAT implementations, which track active connections to translate private IP addresses to public ones.
By carefully injecting or modifying specific entries in the NAT table, the attacker can redirect traffic destined for a legitimate host to an arbitrary endpoint, effectively taking control of the session.
Once the session is hijacked, the attacker can replay or modify packets, allowing for data exfiltration or injection of malicious payloads without the original endpoint’s knowledge.
In addition to session hijacking, NatJack can generate forged DNS replies that resolve to the attacker’s IP, bypassing standard DNS validation mechanisms and redirecting clients to malicious sites.
The manipulation also reveals which internal ports are mapped, giving attackers insight into the internal network topology and potential lateral movement opportunities.
Because the attack consumes NAT table entries, a prolonged exploitation can lead to a table exhaustion, denying legitimate connections and causing a denial‑of‑service condition for the affected host.
Stagg presented the findings at Black Hat USA 2026, highlighting the breadth of affected implementations, including Windows, Linux, and various commercial routers.
These findings underline the importance of strict NAT table management and the need for intrusion detection systems to monitor anomalous NAT state changes.
Defenders are advised to employ rate limiting on NAT table updates, use secure DNS protocols such as DNS‑SEC, and regularly audit NAT configurations for unexpected entries.
Future work will focus on developing automated detection of NatJack patterns and integrating countermeasures into existing firewall and router firmware.