Malware that's already on your system can do whatever it wants. NAT punching is not some complicated dark art for people who already have working exploits...