Loading malware…
Meterpreter is the in-memory interactive payload and post-exploitation component of the Metasploit Framework, widely used by penetration testers and also frequently abused by threat actors as a backdoor and remote shell. It is designed to provide interactive control of compromised systems while minimizing on-disk artifacts, and it has been observed in Windows, Linux, and Android contexts. Implementations and stagers exist in multiple forms, including reflective DLL-based payloads, shellcode stagers, Java-based Android payloads, Python-based installers, and variants generated through msfvenom or embedded in custom loaders.
As deployed in malicious operations, Meterpreter commonly provides remote command execution and broader post-compromise access. It is regularly used after initial intrusion to maintain access to servers and endpoints, execute follow-on tooling, and support hands-on-keyboard activity. Reported capabilities in real intrusions include remote shell access, command execution, payload staging and retrieval, reflective loading or process injection, and use as a stepping stone for lateral movement, data theft, or ransomware staging. Android-focused Meterpreter payloads have additionally been used to access SMS messages, contacts, screenshots, and camera views.
Threat actors have repeatedly incorporated Meterpreter into intrusion chains rather than relying exclusively on custom malware. It has been associated with campaigns attributed to Kimsuky, Buhtrap, TA505-linked activity, and other financially motivated or espionage-oriented operators. It has also appeared in ransomware precursor activity, including incidents involving MegaCortex and Entropy-related intrusions, and in malware delivery chains alongside frameworks such as Cobalt Strike. In some campaigns, Meterpreter was deployed through spear-phishing, malicious documents, trojanized software installers, malvertising-driven fake software downloads, exploitation of public vulnerabilities such as Log4Shell, abused build tooling such as MSBuild, or shellcode downloaders embedded in multistage loaders.
Meterpreter is especially notable for its flexibility as a post-exploitation payload. Operators have used it on Windows servers for persistence and remote control, on Linux systems as a remotely controlled shell following exploitation, and on Android through repackaged applications containing Java-based Metasploit components. Its frequent use of in-memory execution, reflective loading, DLL sideloading or preloading chains, and process injection contributes to defense evasion and makes it attractive both for legitimate offensive security work and for malicious intrusion operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
26 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Threat actors now exploit the critical Apache Log4j vulnerability named Log4Shell to infect vulnerable devices with the notorious Dridex banking trojan or Meterpreter. | Today, the cybersecurity research group Cryptolaemus warned that the Log4j vulnerability is now exploited to infect Windows devices with the Dridex Trojan and Linux devices with Meterpreter.
Four hours after the implant was installed, the attackers connected back to the target. One hour later, they used MS17-07 directly against one domain controller to gain AD domain admin rights.
While we were unable to recover the initial vulnerability used, it is possibly the same CVE 2014-0515 Adobe Flash exploit first reported by Cisco TRAC in late July.
In August 2021, Atlassian published a security advisory about CVE-2021-26084 that could enable a threat actor to run arbitrary code on unpatched Confluence Server and Data Center instances. After releasing the advisory, there occur massive scanning and proof-of-concept exploit code in public. We also collect a lot attacking traffic.
This one appears to have been part of a Proxy Logon-based attack that attempted to load a Meterpreter backdoor DLL from a server in Russia.
Meterpreter payload generated for MS15-020 (CVE-2015-0096) In the LNK files created by Meterpreter, as well as other exploit frameworks like Cobalt Strike, the metadata are completely wiped, with the malicious code present in fields not normally parsed by LnkParser. | Meterpreter Payload Figure 3: Meterpreter payload generated for MS15-020 (CVE-2015-0096)
CISA ... linked an intrusion set to this service, allegedly used by nation-state actors exploiting CVE-2022-47966 (Zoho ManageEngine) and CVE-2022-42475 (FortiOS SSL-VPN) vulnerabilities.
CISA ... linked an intrusion set to this service, allegedly used by nation-state actors exploiting CVE-2022-47966 (Zoho ManageEngine) and CVE-2022-42475 (FortiOS SSL-VPN) vulnerabilities.
D’autres vulnérabilités ont également été observées dans des campagnes transportant Meterpreter, notamment CVE-2024-27956, CVE-2018-7600 (Drupalgeddon 2), CVE-2021-26855 (ProxyLogon – Microsoft Exchange), CVE-2023-46604 (Apache ActiveMQ RCE), CVE-2022-47986 (IBM Aspera Faspex RCE), CVE-2023-27350 (PaperCut NG/MF RCE) ainsi que CVE-2018-7602 (Drupalgeddon 3). | Meterpreter est un Malware qui fournit une console d’accès furtive et interactive sur une machine compromise. Il fonctionne entièrement en mémoire, évite l’écriture sur le disque, et offre des fonctions comme le contrôle du système, l’exécution de commandes, la capture d’écran, la récupération de fichiers et l’escalade de privilèges.
D’autres vulnérabilités ont également été observées dans des campagnes transportant Meterpreter, notamment CVE-2024-27956, CVE-2018-7600 (Drupalgeddon 2), CVE-2021-26855 (ProxyLogon – Microsoft Exchange), CVE-2023-46604 (Apache ActiveMQ RCE), CVE-2022-47986 (IBM Aspera Faspex RCE), CVE-2023-27350 (PaperCut NG/MF RCE) ainsi que CVE-2018-7602 (Drupalgeddon 3). | Meterpreter est un Malware qui fournit une console d’accès furtive et interactive sur une machine compromise. Il fonctionne entièrement en mémoire, évite l’écriture sur le disque, et offre des fonctions comme le contrôle du système, l’exécution de commandes, la capture d’écran, la récupération de fichiers et l’escalade de privilèges.
D’autres vulnérabilités ont également été observées dans des campagnes transportant Meterpreter, notamment CVE-2024-27956, CVE-2018-7600 (Drupalgeddon 2), CVE-2021-26855 (ProxyLogon – Microsoft Exchange), CVE-2023-46604 (Apache ActiveMQ RCE), CVE-2022-47986 (IBM Aspera Faspex RCE), CVE-2023-27350 (PaperCut NG/MF RCE) ainsi que CVE-2018-7602 (Drupalgeddon 3). | Meterpreter est un Malware qui fournit une console d’accès furtive et interactive sur une machine compromise. Il fonctionne entièrement en mémoire, évite l’écriture sur le disque, et offre des fonctions comme le contrôle du système, l’exécution de commandes, la capture d’écran, la récupération de fichiers et l’escalade de privilèges.
D’autres vulnérabilités ont également été observées dans des campagnes transportant Meterpreter, notamment CVE-2024-27956, CVE-2018-7600 (Drupalgeddon 2), CVE-2021-26855 (ProxyLogon – Microsoft Exchange), CVE-2023-46604 (Apache ActiveMQ RCE), CVE-2022-47986 (IBM Aspera Faspex RCE), CVE-2023-27350 (PaperCut NG/MF RCE) ainsi que CVE-2018-7602 (Drupalgeddon 3). | Meterpreter est un Malware qui fournit une console d’accès furtive et interactive sur une machine compromise. Il fonctionne entièrement en mémoire, évite l’écriture sur le disque, et offre des fonctions comme le contrôle du système, l’exécution de commandes, la capture d’écran, la récupération de fichiers et l’escalade de privilèges.
Parmi les failles les plus fréquemment associées au déploiement du payload figurent CVE-2017-0143 (SMBv1 – EternalBlue) et CVE-2023-22527 (injection de templates Atlassian Confluence). | Meterpreter est un Malware qui fournit une console d’accès furtive et interactive sur une machine compromise. Il fonctionne entièrement en mémoire, évite l’écriture sur le disque, et offre des fonctions comme le contrôle du système, l’exécution de commandes, la capture d’écran, la récupération de fichiers et l’escalade de privilèges.
Parmi les failles les plus fréquemment associées au déploiement du payload figurent CVE-2017-0143 (SMBv1 – EternalBlue) et CVE-2023-22527 (injection de templates Atlassian Confluence). | Meterpreter est un Malware qui fournit une console d’accès furtive et interactive sur une machine compromise. Il fonctionne entièrement en mémoire, évite l’écriture sur le disque, et offre des fonctions comme le contrôle du système, l’exécution de commandes, la capture d’écran, la récupération de fichiers et l’escalade de privilèges.
D’autres vulnérabilités ont également été observées dans des campagnes transportant Meterpreter, notamment CVE-2024-27956, CVE-2018-7600 (Drupalgeddon 2), CVE-2021-26855 (ProxyLogon – Microsoft Exchange), CVE-2023-46604 (Apache ActiveMQ RCE), CVE-2022-47986 (IBM Aspera Faspex RCE), CVE-2023-27350 (PaperCut NG/MF RCE) ainsi que CVE-2018-7602 (Drupalgeddon 3). | Meterpreter est un Malware qui fournit une console d’accès furtive et interactive sur une machine compromise. Il fonctionne entièrement en mémoire, évite l’écriture sur le disque, et offre des fonctions comme le contrôle du système, l’exécution de commandes, la capture d’écran, la récupération de fichiers et l’escalade de privilèges.
D’autres vulnérabilités ont également été observées dans des campagnes transportant Meterpreter, notamment CVE-2024-27956, CVE-2018-7600 (Drupalgeddon 2), CVE-2021-26855 (ProxyLogon – Microsoft Exchange), CVE-2023-46604 (Apache ActiveMQ RCE), CVE-2022-47986 (IBM Aspera Faspex RCE), CVE-2023-27350 (PaperCut NG/MF RCE) ainsi que CVE-2018-7602 (Drupalgeddon 3). | Meterpreter est un Malware qui fournit une console d’accès furtive et interactive sur une machine compromise. Il fonctionne entièrement en mémoire, évite l’écriture sur le disque, et offre des fonctions comme le contrôle du système, l’exécution de commandes, la capture d’écran, la récupération de fichiers et l’escalade de privilèges.
modules/exploits/multi/http/wp_plugin_pix_unauth_rce_cve_2026_3891.rb ... [+] The target appears to be vulnerable. ... Successfully retrieved nonce ... Uploading payload ... Payload uploaded successfully ... Meterpreter session 1 opened | [*] No payload configured, defaulting to php/meterpreter/reverse_tcp ... payload => php/meterpreter/reverse_tcp ... [*] Meterpreter session 1 opened
On the 6th of April 2022, NCC Group’s Fox-IT discovered two separate flaws in FUJITSU CentricStor Control Center V8.1 which allows an attacker to gain remote code execution on the appliance without prior authentication or authorization. These are tracked as CVE-2022-31794 and CVE-2022-31795
'DefaultOptions' => { 'Payload' => 'windows/meterpreter/reverse_tcp' } ... 'DefaultOptions' => { 'Payload' => 'linux/x86/meterpreter/reverse_tcp' }
On the 6th of April 2022, NCC Group’s Fox-IT discovered two separate flaws in FUJITSU CentricStor Control Center V8.1 which allows an attacker to gain remote code execution on the appliance without prior authentication or authorization. These are tracked as CVE-2022-31794 and CVE-2022-31795
WICKED PANDA ... began 2020 by conducting a wide-ranging campaign focused on exploiting multiple vulnerabilities (CVE-2019-19781 and CVE-2020-10189) ... deployed Cobalt Strike and Meterpreter payloads
WICKED PANDA ... began 2020 by conducting a wide-ranging campaign focused on exploiting multiple vulnerabilities (CVE-2019-19781 and CVE-2020-10189) ... Upon successful exploitation, they deployed Cobalt Strike and Meterpreter payloads
It triggers on error messages indicating the print spooler failed to load a plug-in module, such as "meterpreter.dll," with error code 0x45A. | The following analytic detects driver load errors in the Windows PrintService Admin logs, specifically identifying issues related to CVE-2021-34527 (PrintNightmare). It triggers on error messages indicating the print spooler failed to load a plug-in module, such as "meterpreter.dll," with error code 0x45A.
Metasploit uses printf to write the Meterpreter stager to disk in 20ish byte chunks (each exploit attempt must fit within a 26 byte buffer), which is quite slow.
Table 1: Filenames and hashes of files used by a threat actor Filename MD5 t.py (tied to scheduled task, python meterpreter reverse shell port 9090) ... g.py (tied to scheduled task, python meterpreter reverse shell port 8088) ...
Threat actors are actively exploiting a recently disclosed critical vulnerability, tracked as CVE-2026-1731 (CVSS score: 9.9), in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA). The bug could allow an unauthenticated attacker to send specially crafted requests and run operating system commands remotely, without logging in.
29 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
When attacking Windows Server, Meterpreter, one of the payload codes provided by Metasploit... was used for the attack... To maintain the continuity of the attack target, the meterpreter of Metasploit is used in the attack to enable continuous server access.
The first one is a very small shellcode downloader, while the second one is Metasploit’s Meterpreter. Meterpreter is a reverse shell that grants its operators full access to the compromised system. The Meterpreter reverse shell actually uses DNS tunnelling to communicate with its C&C server.
Finally, once full domain compromise was achieved, the attackers pivoted through the entire network again using smbexec and launched Metasploit as TCP listen meterpreter in order to plant SDBbot backdoors in more than 50 servers and workstations.
Another file, %TEMP%\msedgeupdate.dll , is then seen on victim machines. But this file is actually Meterpreter, a tool that is part of the Metasploit framework and which can be used for remote access.
At the first sample analysed, the sample content the same combo Cobalt Strike and Meterpreter...
At the first sample analysed, the sample content the same combo Cobalt Strike and Meterpreter...
26 distinct techniques documented for this family, organized by ATT&CK tactic.
We’ve uncovered some new data and likely attribution regarding a series of APT watering hole attacks this past summer... they compromised several sites, including a well-known Uyghur website written in that native language. | Watering hole attacks offer a much better chance of success because they involve compromising legitimate websites and installing malware intended to compromise website visitors.
On Windows Server, when the malware is executed, it self-replicates and is registered in the scheduler.
Open a socket towards the attacker’s server (this is called a reverse shell). The argument “url” is read from the malware’s hard coded configuration. | We explained a genuine COVID-19 contact tracing app was trojanized with a Java-based Meterpreter.
For now the tool rely on PowerShell the execute the final shellcode payload... Generate PowerShell payload to execute on the victim system.
it will assume the device is running Linux/Unix and download and execute a Python script to install Meterpreter.
DKMC is a tool that generates obfuscated shellcode that is stored inside of polyglot images. The image is 100% valid and also 100% valid shellcode.
Currently this exploit will inject your shellcode to new EQNEDT32.EXE process if you specify -i flag.
the DLL file to be executed is injected into the normal process (rundll32.exe) and executed.
As of this research, the most common malicious use of cloud tunneling services is for setting up phishing pages and malware C&C servers.
9.2 Non-application layer & non-standard protocol... Reverse Shell - 27.102.114.63:3101 ... final execution shellcode is socket communication.
attackers (and security researchers) have created tools to attempt to bypass or disable AMSI... attackers continue to adjust—using automated tools in some cases to obfuscate their attack code and probing defenses until they find one that sticks, and finding other ways to avoid AMSI altogether. | Graeber’s single line of PowerShell code flips the flag on an attribute for PowerShell’s AMSI integration—amsiInitFailed— to “true”, which then causes the current PowerShell process to stop requesting scans.
305 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
178 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A final payload loaded by BumbleBee after contacting command-and-control infrastructure.
Meterpreter is the post-exploitation payload used by the Metasploit exploit module to establish an interactive reverse TCP session on the compromised host.
Meterpreter is referenced as a Metasploit payload, specifically the linux/multi/meterpreter_reverse_tcp payload. In this content it is discussed in the context of cache generation/build automation issues for multi-architecture payloads, not as an active malware campaign.
Meterpreter1
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.