Neither Malware nor Harmless: Tracking the NPS Proxy Across the Internet

This report analyzes NPS, a popular open-source reverse tunneling/proxy server frequently deployed in Chinese cloud infrastructure; while often legitimate, it has been observed abused by threat actors (including PRC-linked operators) as a secondary post-exploitation tunneller to pivot into internal networks, with Censys telemetry showing ~17,500 instances and documented cases alongside Cobalt Strike and webshells.