Synack Red Team researcher Malcolm Stagg presents NatJack attack class
2 companies named across 4 categories, one of 6 articles referencing Synack. Previous coverage: Proofpoint and vendors add AI security telemetry - Week of May 25, 2026 (May 2026).
Best suited for
- Seniority
- Analyst
- Job function
- Cybersecurity / Security Operations
- Persona
- Security Operations Leader
- Buyer role
- Decision Maker / Budget Holder
- Decision stage
- Which to buy
- Adoption curve
- Early Majority
- Technology maturity
- Emerging Exploration
- Industry
- Information Technology / Software & Services / IT Services / Cloud Services
Our classification, not the publisher's statement. Best suited for, not only for.
Synack Red Team researcher Malcolm Stagg presented research on NatJack, an attack class that targets design assumptions in network address translation implementations. The work is relevant to enterprise network and security teams because it focuses on how NAT behavior can be manipulated rather than on a single software coding error.
The research described how testing identified affected behavior across independently developed NAT implementations, including Windows, Linux and macOS, and how two CVEs were assigned. Stagg conducted the research over several years and credited Synack Red Team alongside his own research handle Sodium-24, of SODIUM-24, LLC.
NatJack was described as stemming from a design assumption that devices sharing a NAT table can trust one another. The research said it can be behavioral rather than signature-based, and that conventional automated scanning may not detect it. Stagg outlined four techniques: hijacking active TCP connections, poisoning DNS responses, identifying ports assigned to other connections, and forcing denial of service by exhausting a NAT table.
Two CVEs were identified as affecting Microsoft Windows NAT in Hyper-V and the Linux netfilter conntrack subsystem. The article said there was no single patch, and that available fixes included a Linux kernel patch (kernel 6.6.142 and higher) and a FreeBSD update (15.0 and higher), which raise exploitation difficulty but do not close the underlying design gap. In the interim, Synack recommended traffic encryption, segmenting untrusted workloads away from trusted ones, and enabling protections such as IP Source Guard. “Malcolm’s research on NatJack shows why effective security testing must challenge long-held design assumptions, not only search for familiar software flaws,” said Mark Kuhr, co-founder and CTO of Synack.
Press release, provided by Globe Newswire on behalf of Synack. Read the original.