Malcolm Stagg

Ethical hacker @synackredteam. Working on software/electronics, AI and robotics projects @sodium_24. Former @DARPA challenge competitor. Opinions are my own.

[Malcolm Stagg @malcolmst]

Thanks @SynackRedTeam and The Datatech Times! Glad to be able to share some more about this research.

[Synack Red Team @SynackRedTeam]

Nice writeup from The Datatech Times on @malcolmst and his NatJack research. Stagg first discovered that NAT table entries could be corrupted or replaced while on assignment for the Synack Red Team.

In his own words: “For a lot of business and enterprise customers, I would say the TCP and HTTP session hijacking techniques are the most dangerous, since a lot of internal network traffic is still unencrypted, and untrusted/trusted workloads often share the same NAT."

Worth the read if you want the story behind the NatJack research: https://t.co/U8CwAgeMFK

[Malcolm Stagg @malcolmst]

I have posted a white paper with additional technical details about the NatJack attack class on https://t.co/joOs0LGTNg. I hope this will be useful! #natjack

[Malcolm Stagg @malcolmst]

White paper still coming soon! I recently adopted a really sweet stay kitten, Albireo, so it got slightly delayed :). #natjack

[Malcolm Stagg @malcolmst]

I updated https://t.co/joOs0LGTNg with a vendor patch status matrix based on my testing. I will continue to update this on a best-effort basis, but can't guarantee it will always contain the latest information. I hope it will be helpful though! #natjack

[Malcolm Stagg @malcolmst]

First set of NatJack demo videos are now live, with demonstrations taking place against the Docker network bridge. White paper to follow soon! #natjack https://t.co/8I1HN3n0mR

[Malcolm Stagg @malcolmst]

For anyone looking for more technical details in the meantime, my Black Hat slides are available for download here: https://t.co/HROCUXR2y1 . #BHUSA #BHUSA26 #natjack

[Malcolm Stagg @malcolmst]

I plan on posting a few demo videos and white paper with some more technical details later this week. Stay tuned! #natjack

[Malcolm Stagg @malcolmst]

A product patch status matrix will also be posted on https://t.co/Mv3sxp5ezA once I can audit it for accuracy. It will be updated on a best-effort basis and shouldn’t be considered an authoritative guide. #natjack

[Malcolm Stagg @malcolmst]

Microsoft patched and published CVE-2026-56179 which relates to NatJack today, affecting Hyper-V in an upstream spoofing configuration. I have updated https://t.co/Mv3sxp5ezA with the CVE. Thank you @msftsecresponse for your work mitigating this! https://t.co/omRk95pi2E #natjack

[Malcolm Stagg @malcolmst]

Great to see these proactive mitigations @geteero 👍 https://t.co/Y949B1yUI8

[Malcolm Stagg @malcolmst]

@phyr3wall Thanks dude!

[The Hacker News @TheHackersNews]

🚨 Another system behind the same NAT could hijack your connection.

New NatJack attacks can redirect live TCP sessions, spoof DNS replies, expose victim IPs/ports, or cause DoS. The researcher tested 32 products/configs across 13 vendors; Windows and Linux flaws now have CVEs.

How the attack works: https://t.co/SGRzLKLbJ6

[Synack @synack]

Happening NOW at #BlackHatUSA! @SynackRedTeam Researcher @malcolmst is revealing NatJack, a newly developed network address translation (NAT) table manipulation attack class effective against most virtual and physical network infrastructure performing NAT.

Learn more about the new attack class here: https://t.co/tloyHxbuBu

[Sean Kerner @TechJournalist]

NatJack attack class exposes design flaw across decades of network infrastructure. #blackhat

“A lot of networks are vulnerable to this, and you can’t always rely on the layer two isolations that are in place.."

https://t.co/7Qw1HLxGNM

[Malcolm Stagg @malcolmst]

I will discuss more about this and other issues during my Black Hat briefing, which is now scheduled as a live presentation on August 6 (10:15am in Oceanside D). Feel free to join in if you will be attending Black Hat this year!

[Malcolm Stagg @malcolmst]

Although I don’t fully agree with implied attack preconditions and severity, I appreciate @msftsecresponse work to patch and publish CVE-2026-56181 yesterday!
https://t.co/A8V6RCMGdb

[Malcolm Stagg @malcolmst]

I look forward to discussing the range of vendor responses during my talk at Black Hat. Despite following all responsible disclosure guidelines, this may include, unfortunately, live demos of vulnerabilities which have not been patched due to inappropriate vendor responses.

[Malcolm Stagg @malcolmst]

Responses from several VDPs on this vulnerability class make me wonder if public disclosure is generally a better approach. It seems a number one vendor priority right now is finding ways to dismiss issues and avoid paying, or reducing severity rating, putting customers at risk.

[Malcolm Stagg @malcolmst]

At this point, there have been a large range of vendor reactions to this research, ranging from “intended design” and “totally bogus” to reports accepted at P1 priority. Still curious to see how it all unfolds in terms of vendor patches prior to disclosure.

[Malcolm Stagg @malcolmst]

I’m excited to be presenting at Black Hat USA this year! My presentation is titled “Breaking Trust Boundaries: Exploiting Design Assumptions in Network Infrastructure” https://t.co/kFwlmr4uEG

[Malcolm Stagg @malcolmst]

This will be available as an on-demand briefing to conference attendees, then later published on the YouTube channel. This research is currently under coordinated disclosure with multiple vendors affected. I’ll try to share more details closer to the conference.