A newly disclosed NatJack attack class reveals a fundamental vulnerability in network address translation (NAT) infrastructure, allowing attackers to manipulate connection-tracking states, hijack TCP sessions, tamper with DNS traffic, disclose mapped ports, and deny access to other users This article explores malicious infrastructure dns. . Presented by security researcher Malcolm Stagg at Black Hat USA 2026, NatJack is not confined to a single vendor, operating system, or network appliance.
Instead, it targets longstanding trust assumptions embedded in NAT implementations: that hosts behind the same translating device cannot maliciously alter each other's connection states. NatJack also provides a method for manipulating UDP DNS responses.
An attacker can interfere with a pending NAT mapping for a victim’s DNS query, causing the legitimate response to be redirected to an attacker-controlled system and subsequently returning a forged response that would trick the victim into accessing malicious infrastructure where DNS integrity protections are not in place. This risk is most relevant when trusted and untrusted systems share NAT infrastructure: corporate networks, multi-tenant cloud environments, Docker hosts, Kubernetes nodes, virtual-machine platforms, serverless deployments, and home routers.
Organizations should apply vendor updates, isolate untrusted workloads from trusted systems using NAT devices, enable IP Source Guard for anti-spoofing controls, monitor NAT table usage and anomalous SYN/RST activity, encrypt internal traffic with TLS, deploy authenticated DNS protections, and utilize in-browser data inspection tools like ANY.RUN to detect and respond faster.
