NatJack Attack Class Hijacks TCP Sessions and Spoofs DNS by Manipulating NAT Tables
What Happened — Security researcher Malcolm Stagg disclosed a new attack class, NatJack, that corrupts NAT connection‑state tables to hijack live TCP sessions, inject spoofed DNS responses, expose internal port mappings, and exhaust NAT resources. The technique works against multiple, independently developed NAT implementations, including Windows built‑in NAT and several open‑source routers.
Why It Matters for Compliance & Audit Readiness
- NAT manipulation bypasses network segmentation controls that SOC 2 CC6 (System Operations) expects to be continuously monitored and logged.
- Spoofed DNS can undermine the integrity of data in transit, a direct violation of the SOC 2 CC5 (Security) principle of protecting communications.
- Demonstrates a control‑gap where evidence of NAT‑state changes is rarely collected, highlighting the need for continuous control mapping and audit‑ready evidence.
Who Is Affected — Enterprises that rely on NAT for cloud‑front, remote‑access VPNs, or on‑premise edge routing; broadly spans technology, finance, healthcare, and retail sectors.
Recommended Actions
- Inventory all NAT devices (Windows, Linux iptables, commercial routers) and map them to SOC 2 CC6/CC7 controls.
- Enable detailed NAT‑state logging and forward logs to a SIEM for real‑time anomaly detection.
- Deploy continuous configuration monitoring to detect unexpected NAT‑table changes.
- Incorporate NAT‑state change logs into your audit evidence repository to satisfy SOC 2 “monitoring and logging” requirements.
Source: The Hacker News
Technical Notes — NatJack exploits the lack of integrity checks on NAT connection‑state entries, allowing an attacker with network‑level access to overwrite entries, hijack TCP streams, and forge DNS replies. No CVE has been assigned yet; the research was presented at Black Hat USA 2026.