Neither Malware nor Harmless: Tracking the NPS Proxy Across the Internet

NPS is a widely used, dual-purpose Chinese tunneling tool whose legitimate network administration capabilities are increasingly leveraged by threat actors—often alongside other remote access tools—for stealthy post-exploitation pivoting, making context-driven detection essential for distinguishing benign from malicious use.