Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
NatJack Lets Attackers Hijack TCP Sessions, Spoof DNS, and Exhaust NAT Tables
Malware Families
Excerpt
A newly disclosed NatJack attack class exposes a foundational weakness in network address translation (NAT) infrastructure, enabling attackers to manipulate connection-tracking state to hijack TCP sessions , tamper with DNS traffic, disclose mapped ports, and deny network access to other users. Presented by security researcher Malcolm Stagg at Black Hat USA 2026, NatJack is not limited to one vendor, operating system, or network appliance. Instead, it targets longstanding…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-63913 | Medium | Score 51/100 | First seen |
| CVE | CVE-2026-56181 | Medium | Score 54/100 | First seen |
IOC Relationship Graph
Building graph…