SECURITY Signal 61
Neither Malware nor Harmless: Tracking the NPS Proxy Across the Internet
↗
Illustration only Photo by Aaron McLean on Unsplash
NPS is a lightweight, open-source Go-based proxy and tunneling server designed to let operators create reverse proxy connections that route traffic through a central server.
Engineers need to know about NPS because it provides a simple way to establish reverse tunnels, which can be used for legitimate remote access or for covert command-and-control. Monitoring its traffic helps distinguish benign internal tooling from malicious activity. Because NPS is not labeled as malware, detection must rely on behavioral and contextual analysis rather than signature-based blocking.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
NPS is a lightweight, open-source proxy and tunneling server implemented in Go.
It is described as a powerful intranet penetration proxy server that enables easy creation of reverse proxy connections.
Those connections route traffic back through a central server, allowing operators to tunnel internal services outward.
THE CLUSTER