Learn
archived
NatJack: NAT Manipulation Enables TCP Hijack and DNS Spoofing
- Engineer — Learn: Novel attack class affecting multiple NAT implementations including Windows — no active exploitation or patches announced yet, so monitor for vendor advisories and evaluate whether firewall rule hardening or NAT timeout tuning applies to your perimeter.
- SOC/IR — Learn: NatJack introduces TCP session hijacking and DNS spoofing via NAT state manipulation; no IOCs or ATT&CK-mapped TTPs are available yet, so track for detection research as the community digests the Black Hat presentation.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.