Executive Summary
- NPS is an open-source tunneling tool, popular with the Chinese-speaking security community.
- Deployment of NPS is heavily concentrated within China hosting providers.
- NPS has been previously observed deployed alongside other remote access tools by multiple actors from the People’s Republic of China.
- It uses a client-server model enabling users to create reverse network tunnels
NPS is a lightweight, open-source proxy and tunneling server written in Go. Described in the original readme as a “powerful intranet penetration proxy server,” it is designed to allow operators to easily create reverse proxy connections that connect back through a central server, allowing attackers to rapidly pivot against internal infrastructure.
While NPS has legitimate, benign applications, it has also been leveraged in intrusions, including by named threat actors operating from the People’s Republic of China, as discussed later in this post. Operationally, NPS gives an operator a low-footprint reverse tunnel that can be deployed alongside existing control channels to support further network pivoting and access to internal resources.
NPS is not a fringe utility. Its upstream project has drawn more than 34,000 GitHub stars and 6,000 forks since 2018, and as of July 2026 Censys observes ~17,500 hosts running NPS (server component) worldwide. Deployment is heavily concentrated in China (62%) and Hong Kong (18%) and clustered in Chinese cloud providers, led by Alibaba (~7,200 hosts), Tencent (~2,900), and China Telecom’s backbone (~2,100).
NPS
NPS was first published to GitHub in November 2018 and has become one of the most popular open-source penetration tools in the Chinese-speaking security community. It ships openly as source and precompiled binaries for Linux, Windows, and macOS. The original repository is no longer actively developed, but the codebase lives on through many forks, including the actively maintained djylb/nps and various threat-actor-observed variants.
NPS can be logically divided into its two parts: an NPS server exposes a web management panel and a client bridge, while an NPC client is used to connect back from inside a network. A diagram of this is shown below:
Although the tunnel created by NPC is established outbound from inside the network, traffic exits at the internal NPC host rather than through the server, making it a pivot into a network rather than a path out to the internet.
Capabilities
NPS provides a broad set of tunneling and proxying capabilities:
- Reverse SOCKS5 proxy that exposes an internal network through a single outbound tunnel.
- Forwarding TCP, UDP, HTTP/S, and SOCKS5 traffic over one connection.
- A web management panel for configuring and operating tunnels remotely.
- Installation as a system service on both client and server hosts.
- TCP and UDP port forwarding to individual internal hosts.
- A P2P mode for direct client-to-client connections.
- Optional transport encryption, though the web panel serves plaintext HTTP by default.
NPS diverges from what many would typically classify as malware. It is proxy and tunneling software, engineered to route traffic between locations that may not have line of sight connectivity due to Network Address Translation (NAT) and/or other network controls. The overwhelming majority of its deployments are likely ordinary administrative ones, enabling connectivity between networks. What earns it a place in our threat tracking is its reported dual use for legitimate and malicious usage: the same capability that lets an engineer reach an internal service also lets an intruder bridge into a network they have compromised.
Threat Usage
Once the NPC (NPS client) is running on a foothold and has dialed out to the operator’s NPS server, that server exposes a SOCKS5 listener whose traffic tunnels back through the connection and exits inside the victim network. While the ability to proxy traffic through infected systems is a common feature for most remote access tools, the use of a secondary tool like NPS for forwarding traffic is a mature operational technique. Instead of relying on one connection for both C2 and pivoting, NPS creates a new connection, allowing an attacker to pivot, without risking a connection failure completely disrupting their access.
As part of our research into NPS, we looked closely at two previous instances of NPS being used with a threat actor’s operations. The first report we reviewed was from Sygnia on Emperor Dragonfly, which showed the NPS client (NPC) renamed WindowsUpdate.exe and registered as a service, running next to a Cobalt Strike beacon and Meterpreter (shown in the screenshot below). The usage of NPS in this context was interesting because both of the other post exploitation tools have existing functionality for proxying attacker traffic out through a session on an infected system.
The second report was from a 2023 CISA investigation into a campaign against Citrix NetScaler devices. Their reporting noted a “NPS tunneller” deployed after attackers had deployed a webshell onto a compromised appliance. Again, we see NPS deployed as a secondary post-exploitation tool alongside dedicated C2 tooling. The pattern holds across both: other tooling breaks in and establishes initial command and control, then NPS is deployed to facilitate follow on actions. Actors likely do this to carve out a separate connection for proxied network traffic to avoid overloading or interruption of primary C2 traffic – triggering a loss of access.
Notably, NPS has no native command-execution or remote-shell capability. That limitation is likely a key limitation that prevents it from being used for establishing an initial foothold on a target and why operators deploy it alongside a full remote access tool such as Cobalt Strike.
Censys ARC Perspective
As of July 2026, Censys is seeing between ~17,500 instances of NPS running. When looked at over the past 30 days, hosts running NPS have remained fairly consistent with a minor decline throughout July 2026:
The population is heavily concentrated in China and several large Chinese cloud networks, shown in the following map:
The distribution tells a consistent story: NPS usage is dominated by deployments on Chinese cloud infrastructure. However, from our visibility, under 10% of NPS instances on hosts are also running a service we identify as a threat. We also see thousands of instances with services consistent with personal, or hobbyist self-hosted environments, indicating that NPS’s usage is likely broader than just threat focused usage. The dual legitimate and illegitimate use complicates defense, as a single NPS detection should not always be seen as conclusive evidence of compromise. At the time of this report, we see instances of NPS also running Cobalt Strike, Acunetix, Viper, Supershell, and a mixture of other remote access tools; the cohabitation of NPS alongside these other named threat detections is a stronger signal of potential malicious activity. Censys Enterprise customers with the Adversary Infrastructure module can leverage the following query to see these hosts:
host.services.threats.name: "NPS" and host.services.threats.type=C2_SERVER
NPS is best hunted in context rather than blocked on sight. Organizations should establish where tunneling and proxy software legitimately belongs in their environment, then treat anything outside that baseline as suspect, with the highest priority on NPS that appears next to remote access tooling or bridges to infrastructure they do not own.
Hosts running NPS are annotated in the Censys Platform. Security teams can surface instances identified by Censys with the following query:
host.services.threats.name = "NPS" or web.threats.name = "NPS"
While the result set is large and mostly benign, threat researchers will find value in cross-referencing those hosts against the other threats Censys detects on them. An NPS instance sitting next to Cobalt Strike, a vulnerability scanner, or another remote access tool is a far stronger indicator than NPS on its own. In a population this large, and this benign on its surface, that kind of disciplined, context-driven hunting is what separates benign from malicious.
Further Reading: Vshell, A Chinese-Language Alternative to Cobalt Strike
