New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables

thehackernews.com Aug 7, 2026

New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables

Curated by Shubham · TechCapsules · Aug 7, 2026

AI-summarised brief · reviewed before publication

Security researcher Malcolm Stagg revealed NatJack, an attack that manipulates NAT connection state to hijack TCP sessions, spoof DNS, expose mapped ports, and exhaust NAT tables. Demonstrated at Black Hat USA 2026, the flaw affects Windows Hyper‑V NAT (CVE‑2026‑56181, CVSS 8.3) and Linux Netfilter conntrack (CVE‑2026‑63913, CVSS 8.2). NatJack requires privileged access on the same NAT and can redirect traffic, intercept DNS, or flood NAT tables. No single patch exists; organizations must apply OS updates, encrypt internal traffic, and isolate untrusted workloads.

💡 Why It Matters

· The attack exposes a fundamental trust assumption in NAT, enabling insiders to subvert internal network traffic without external exposure.
· This vulnerability threatens the integrity of corporate networks that rely on shared NAT infrastructure for segmentation.

Capsules Cybersecurity

Read full article on thehackernews.com

ZeroTier and Carahsoft Partner to Expand Post-Quantum Networking Access for Government

ZeroTier and Carahsoft announced a partnership to distribute ZeroTier Quantum, a post‑quantum secure networking platform, to U.S. government agencies via Carahsoft’s reseller network and the SEWP V contract. ZeroTier Quantum uses hybrid post‑quantum cryptography (ML‑KEM‑1024 and ECDH P‑384) within a Rust‑based, Zero‑Trust architecture to secure cloud, on‑premises, edge, and air‑gapped environments. The collaboration aims to help defense and public‑sector organizations modernize network security without replacing existing infrastructure, meeting NIST and NSA CNSA 2.0 standards.

💡 The partnership accelerates government adoption of quantum‑resilient networking, addressing an imminent threat that could compromise current encryption. It enables agencies to deploy high‑performance, end‑to‑end secure connections across diverse environments without costly infrastructure overhauls.

thehackernews.com · Aug 7

Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails

Cybersecurity researchers identified a widespread adversary-in-the-middle phishing campaign targeting Microsoft 365 accounts to harvest payroll and finance emails. Arctic Wolf Labs reported the attack uses residential proxies to disguise malicious sign-ins as legitimate consumer traffic, impacting organizations in healthcare, education, manufacturing, government, and professional services across the U.S., Canada, and Europe. The campaign shares tactics with Microsoft’s tracked Storm-2755 and Storm-2657 threats. Attackers employ voicemail-themed emails leading to a six-stage redirection chain using trusted services like Google and Amazon S3 to bypass filters. This infrastructure captures credentials and multi-factor authentication codes while fingerprinting victim devices. Post-compromise, actors use geolocation data to select matching residential proxies, maintaining sessions via automated eight-hour intervals. They leverage the Microsoft Graph API to identify HR and finance personnel, subsequently accessing sensitive messages related to payroll and invoices to facilitate financial fraud.

💡 The campaign’s sophisticated use of trusted infrastructure and geolocation-matched proxies bypasses standard security controls, allowing attackers to maintain persistent access to sensitive financial data. This evolution in adversary-in-the-middle tactics demonstrates that traditional multi-factor authentication is insufficient against automated session hijacking, leaving organizations vulnerable to direct financial theft through compromised employee accounts.

infosecurity-magazine.com · Aug 7

Only 24% Of organizations Test Identity Recovery Every Six Months

New research from Quest Software reveals that only 24% of organizations test their identity disaster recovery plans every six months, indicating a significant gap in cybersecurity preparedness. The global survey of 650 IT and security practitioners found that while investment in identity threat detection and response is rising, many businesses neglect response readiness. Most companies prioritize preventative controls, creating a false sense of security. When identity systems are compromised, recovery speed determines business impact. Data shows 44% test annually, 8% every two years, and 24% never test. Regular rehearsal correlates with shorter outages. Identity infrastructure is central to modern IT, connecting users and cloud services. Attackers increasingly target this critical control point. Non-human identities and service accounts pose particular risks, often outpacing governance. Respondents cited difficulties securing non-human identities, third-party accounts, and legacy environments. Nearly 80% of organizations remain vulnerable to identity-related breaches, highlighting the urgent need for consistent recovery testing and improved governance across hybrid and cloud platforms.

💡 Organizations over-rely on detection while ignoring recovery, leaving them paralyzed when inevitable breaches occur. This negligence transforms manageable incidents into catastrophic, prolonged outages that cripple operations.

thehackernews.com · Aug 7

Cisco Patches 12 SD-WAN and IOS XE Flaws, Including Three 9.8 CVSS…

Cisco has released security updates for Catalyst SD‑WAN and IOS XE software after an internal review uncovered twelve critical flaws, including three with a CVSS rating of 9.8. The patches address improper access control, command injection, and input‑validation errors in IOS XE, and multiple vulnerabilities in SD‑WAN that affect all device configurations. Cisco also fixed a high‑severity bug in the Integrated Management Controller’s web UI (CVE‑2026‑20200), for which a proof‑of‑concept exploit exists and could let an attacker gain root access, compromising BIOS, SecureBoot and the server’s trust anchor. The company warned that none of the flaws are known to be actively exploited, but urged immediate deployment. This follows a recent alert about active exploitation of a lower‑severity firewall management vulnerability (CVE‑2026‑20316).

💡 Exploiting the IMC flaw would let attackers embed themselves below OS‑level defenses, undermining the hardware root of trust across Cisco‑based networks.

puppet.com · Aug 7

Introducing Unified Compliance as a Foundational Part of Puppet’s Future

Puppet announced the launch of Perforce Unified Compliance, a new feature bundled with Puppet Enterprise Advanced, aimed at delivering continuous governance for modern, AI‑driven infrastructure. The company says traditional compliance methods can’t keep up with the rapid diversification of cloud, on‑premise, and edge environments, leading to fragmented visibility and manual audit work. Unified Compliance links policy definition, enforcement, remediation, and evidence collection across all managed resources, providing real‑time assurance that systems remain secure, compliant, and aligned with business goals. The rollout is positioned as a core component of Puppet’s AI‑Driven Software Development Life Cycle (AI‑SDLC) strategy, reflecting broader industry moves toward integrated, automated control of AI‑enhanced operations.

💡 It gives enterprises a single, automated compliance backbone that can keep pace with the speed and complexity of AI‑augmented infrastructure changes.

techradar.com · Aug 7

Is Google Gemini trained on Google docs? One indie developer thinks so,…

An independent game developer alleges that Google’s Gemini AI accessed private, unreleased details from their Google Docs without explicit permission. The developer claims a player used Gemini to learn specific information, including the character name “Vantage Tripod” and unreleased mechanics, which had only been written in a private document the day prior. While the public knew of a “Tripod Fish” character, the exact name remained secret until the AI interaction. Google maintains that Gemini only accesses Google Docs with express user permission, such as for summarization, and handles data transiently without retention. The company notes exceptions where publicly linked documents or third-party extensions might expose data. Despite these assurances, the developer and some users remain skeptical, citing the accuracy of the leaked information as evidence of unauthorized scraping. Privacy advocates point to ambiguities in Google’s privacy hub regarding content usage for AI training, fueling concerns about data security and potential unauthorized access to private user files within the Google ecosystem.

💡 This incident exposes a critical trust deficit in AI data handling, where perceived privacy guarantees clash with user experiences of data leakage. It forces a reevaluation of how cloud-based AI models interact with private user content, challenging the assumption that "private" documents are safe from training data ingestion.