Censys Tracks NPS Proxy Use and Its Role in Intrusions
Summary
Censys finds about 17,500 NPS servers, mostly in China and Hong Kong. The dual-use tunneling tool has also been deployed alongside other remote access tools in intrusions, so NPS alone is not conclusive evidence of compromise.
Key points
- NPS is an open-source tunneling tool that creates reverse connections, letting operators route traffic through an internal host.
- Censys observed about 17,500 NPS servers as of July 2026; deployments were concentrated in China and Hong Kong.
- NPS has been reported alongside Cobalt Strike and Meterpreter in an Emperor Dragonfly operation, and after a webshell was placed on compromised Citrix NetScaler devices.
- NPS lacks native command-execution or remote-shell capability, so operators have used it alongside other tools.
- Censys found that fewer than 10% of NPS instances also ran a service it identified as a threat; many appear to be legitimate or hobbyist deployments.
- Censys recommends assessing NPS in context, especially when it co-occurs with other remote access tools or bridges to infrastructure an organization does not own.
Article Details
- Attack Vectors
- NPS/NPC can establish an outbound tunnel from a host inside a victim network, allowing an operator to proxy traffic back into that network.
- NPS has been reported as a secondary post-exploitation tool deployed alongside other remote-access or command-and-control tools.
- In a reported Citrix NetScaler intrusion, attackers deployed an NPS tunneller after placing a webshell on a compromised appliance.
- Defensive Notes
- Hunt for NPS in context rather than treating every instance as proof of compromise; compare deployments against an established baseline for legitimate tunneling software.
- Prioritize NPS instances found alongside remote-access or command-and-control tooling, or bridging to infrastructure the organization does not own.
- Cross-reference NPS detections with other threats observed on the same hosts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 111[.]170[.]148[.]141 | Host identified as running NPS alongside CobaltStrike in the reported threat-usage example. |
MITRE ATT&CK
T1090.001 · Internal ProxyNPS exposes a SOCKS5 listener that tunnels traffic back to an internal host, enabling pivoting through an internal proxy.T1543.003 · Windows ServiceIn the Sygnia-reported operation, the NPS client was registered as a service on Windows.T1572 · Protocol TunnelingNPS forwards TCP, UDP, HTTP/S, and SOCKS5 traffic over a tunnel between the client and server.
Threat Actors
Products
Tools
AcunetixAt the time of this report, we see instances of NPS also running Cobalt Strike, Acunetix, Viper, Supershell, and a mixture of other remote access tools; the cohabitation of NPS alongside these other named threatCobalt Strikeshowed the NPS client (NPC) renamed WindowsUpdate.exe and registered as a service, running next to a Cobalt Strike beacon and Meterpreter (shown in the screenshot below).Meterpreterrenamed WindowsUpdate.exe and registered as a service, running next to a Cobalt Strike beacon and Meterpreter (shown in the screenshot below).NPCNPS can be logically divided into its two parts: an NPS server exposes a web management panel and a client bridge, while an NPC client is used to connect back from inside a network.NPSNPS is an open-source tunneling tool, popular with the Chinese-speaking security community.SuperShellAt the time of this report, we see instances of NPS also running Cobalt Strike, Acunetix, Viper, Supershell, and a mixture of other remote access tools; the cohabitation of NPS alongside these other named threatViperAt the time of this report, we see instances of NPS also running Cobalt Strike, Acunetix, Viper, Supershell, and a mixture of other remote access tools; the cohabitation of NPS alongside these other named threat