NatJack Attacks Manipulate NAT Tables to Hijack TCP Sessions and Spoof DNS
A new attack class named NatJack, presented at Black Hat USA 2026, manipulates network address translation (NAT) connection state to hijack TCP sessions and spoof DNS responses.
Security researchers have unveiled a novel attack class dubbed NatJack, capable of manipulating network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables. Malcolm Stagg, a researcher who presented his findings at Black Hat USA 2026, detailed how this attack vector affects multiple NAT implementations, including those found in Windows operating systems.
The core of the NatJack attack lies in its exploitation of the connection state maintained by NAT devices. By carefully crafting network traffic, an attacker can induce the NAT device to reveal information about its internal mapping of ports. This information can then be leveraged to inject malicious packets into an existing, legitimate TCP session, effectively hijacking it. This allows attackers to intercept or redirect traffic, potentially leading to data theft or further compromise.
Beyond session hijacking, NatJack also demonstrates the ability to spoof DNS responses. By manipulating the NAT's state and potentially hijacking DNS queries, attackers can direct users to malicious websites or servers, even if they attempt to navigate to legitimate destinations. This capability significantly enhances the potential for phishing, malware distribution, and man-in-the-middle attacks.
Furthermore, the research highlights that NatJack can be used to exhaust NAT tables. By creating a large number of connections or manipulating existing ones in specific ways, attackers can overwhelm the NAT device's resources, leading to a denial-of-service condition. This can disrupt network connectivity for legitimate users and potentially serve as a precursor to other malicious activities.
Stagg's research indicated that the vulnerabilities exploited by NatJack are not confined to a single vendor or implementation. The attack demonstrated effective behavior across independently developed NAT implementations, underscoring a widespread potential impact across diverse network environments. This broad applicability makes NatJack a significant concern for network security professionals.
The implications of NatJack are substantial. The ability to hijack established TCP sessions and spoof DNS responses bypasses many traditional security controls that focus on initial connection authentication. It highlights a critical need for NAT devices and network security solutions to implement more robust state management and validation mechanisms to detect and prevent such manipulations.
While specific patches or vendor advisories directly addressing NatJack were not immediately available following the Black Hat presentation, the research serves as a critical alert. Network administrators are advised to review their NAT configurations, monitor network traffic for anomalous patterns, and stay informed about potential vendor updates that may emerge to mitigate this emerging threat class.
This discovery underscores the ongoing evolution of network attack vectors, moving beyond simple packet sniffing or exploitation of known vulnerabilities to more sophisticated manipulation of fundamental network protocols and device states. The NatJack attack serves as a potent reminder that even established network infrastructure components like NAT can harbor exploitable weaknesses.