Loading malware…
Meterpreter is an extensible remote-access and post-exploitation payload in the open-source Metasploit Framework. Developed for penetration testing and security assessments, it is also widely abused by cybercriminal and espionage actors to control compromised systems. Observed deployments include Windows and Linux payloads and a Java implementation.
Meterpreter provides interactive sessions and supports scripted post-exploitation automation through Metasploit. Documented activities include command execution, host and domain reconnaissance, keystroke logging, network sniffing, process migration, and privilege escalation. In observed Windows intrusions, operators injected Meterpreter into legitimate processes, migrated it between processes, and used its privilege-escalation functionality to obtain SYSTEM access. Attackers have also maintained Meterpreter access through scheduled tasks.
Communication options include reverse TCP, bind listeners, HTTP, and HTTPS. Windows HTTP and HTTPS transports can inherit the user's proxy configuration and authentication settings. Transaction-based HTTP transports support reconnection after connectivity interruptions or handler restarts while preserving session state, subject to configurable expiration and communication timeouts. HTTPS encrypts the communication channel.
Meterpreter is delivered through exploitation of vulnerable applications and by other malware, including BumbleBee. It has appeared in phishing-led infection chains and intrusions exploiting Log4j and PaperCut vulnerabilities. Documented users include FIN10, Earth Estries, IndigoZebra, Shedding Zmiy, and UAT-10147. Its availability and use by unrelated operators make its presence insufficient for threat-actor attribution.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
29 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
A contributor describes a "Cisco secure email gateway SQLi via ECS RCE module" and says they "think is CVE-2026-76461." The accompanying Metasploit demonstration opens a Meterpreter session, with getuid returning "Server username: root."
Add x86 (32-bit) support to MS17-010 EternalBlue. Tested against Windows 7 Professional SP1 x86: SYSTEM Meterpreter session.
“CVE-2026-81578 is an unauthenticated request that can reach an admin-only Tapestry component (CVSS 8.8).” The recovered workbench contained vulnerability probes and working exploit code chaining it with CVE-2026-82078. | It loads exploit/multi/http/papercut_ng_external_user_lookup_rce with a Java Meterpreter payload, establishes a session, creates a local administrator account, resets the built-in Administrator account, and applies modified security policies before escalating to SYSTEM.
“CVE-2026-82078 is an unsafe reflection issue in the JDBC driver loading path (CVSS 9.4).” The report reconstructs the “CVE-2026-81578 → CVE-2026-82078 path from unauthenticated POST to code execution.” | It loads exploit/multi/http/papercut_ng_external_user_lookup_rce with a Java Meterpreter payload, establishes a session, creates a local administrator account, resets the built-in Administrator account, and applies modified security policies before escalating to SYSTEM.
The content describes adding CVE-2026-76443 against Cisco Secure Email Gateway and demonstrates the Metasploit module unix/smtp/cisco_secure_email_gateway_smime_sqli_rce on version 15.5.1-055. A signed S/MIME exploit email is accepted, opening a Meterpreter session with the server username root.
“Add Exploit Module for GitLab RCE via CI Lint [CVE-2026-97229].” The demonstration reports “GitLab 19.4.1 appears affected,” followed by an unauthenticated CI lint request and a successfully opened Meterpreter session running as user git.
CVE-2023-46604 allows remote attackers with network access to a broker to execute arbitrary shell commands. This is achieved by exploiting serialized class types within the OpenWire protocol, which, in turn, leads to the broker instantiating any class available on the classpath.
The report identifies CVE-2022-42475 (FortiOS SSL-VPN) among vulnerabilities exploited by alleged nation-state actors using Safe VPN infrastructure. It also describes Mandiant reporting exploitation of vulnerable FortiOS devices involving BOLDMOVE for cyberespionage, with low-confidence attribution to Chinese threat actors.
As early as January 4, attackers started exploiting the CVE-2021-44228 vulnerability in internet-facing systems running VMware Horizon. Our investigation shows that successful intrusions in these campaigns led to the deployment of the NightSky ransomware. | In addition to the Cobalt Strike and PowerShell reverse shells seen in earlier reports, we’ve also seen Meterpreter, Bladabindi, and HabitsRAT.
The report links safe-vpn[.]mobi to infrastructure allegedly used by nation-state actors exploiting CVE-2022-47966 (Zoho ManageEngine) and CVE-2022-42475 (FortiOS SSL-VPN). After compromise, a malicious Windows executable, described as likely Metasploit/Meterpreter shellcode, connected to a remote IP for further in-memory payload injection.
CISA is providing this update to alert administrators that threat actors who successfully exploited CVE-2019-11510 and stole a victim organization’s credentials will still be able to access—and move laterally through—that organization’s network after the organization has patched this vulnerability if the organization did not change those stolen credentials.
This module exploits CVE-2026-19286 by using authenticated flow creation to store a Python payload and the public A2A endpoint to execute it. Langflow versions 1.11.0 and 1.11.1 are described as susceptible. | Payload options (python/meterpreter/reverse_tcp)
OpenIdentityPlatform OpenAM versions 16.0.5 and earlier deserialize the jato.clientSession parameter on JATO ViewBean endpoints, including ui/PWResetUserValidation, without validation. The supplied exploit module achieves unauthenticated remote code execution using an Apache Click ColumnComparator and Xalan TemplatesImpl gadget chain. | The exploit module provides a Linux x64 Meterpreter dropper via CmdStager; the example execution stages a Linux x64 Meterpreter payload and opens a Meterpreter session on the target.
"linux/mipsle/meterpreter/reverse_tcp" is named as the payload in the Netis NC63 RCE module.
The unpacked shellcode from afk.ttf was a Meterpreter payload, and Meterpreter's hashdump module was later used to collect the SAM database.
The long WebDAV PROPFIND If header was identified as an exploit for the IIS 6.0 WebDAV CVE-2017-7269 vulnerability and was assessed as the initial infection vector. | The decoded exploit payload was concluded to be a "reverse_tcp_rc4 Meterpreter stager" with XORKEY set to KXOR and RC4Key set to killervulture123.
The Metasploit module `simplehelp_oidc_auth_bypass_rce` identifies SimpleHelp 5.5.14 as vulnerable, submits a forged unsigned identity token (`alg: none`) for a technician account, then uses the authenticated technician session to execute a payload on a managed machine.
The Linux attacks, like in the case, leverage various known vulnerabilities to obtain an initial foothold, followed by abusing various known Local Privilege Escalation (LPE) exploits to escalate to root, including CVE-2022-0995, CVE-2021-3156, CVE-2015-5287, CVE-2015-3246, CVE-2010-3904, and CVE-2022-0847.
The Linux attacks, like in the case, leverage various known vulnerabilities to obtain an initial foothold, followed by abusing various known Local Privilege Escalation (LPE) exploits to escalate to root, including CVE-2022-0995, CVE-2021-3156, CVE-2015-5287, CVE-2015-3246, CVE-2010-3904, and CVE-2022-0847.
The Linux attacks, like in the case, leverage various known vulnerabilities to obtain an initial foothold, followed by abusing various known Local Privilege Escalation (LPE) exploits to escalate to root, including CVE-2022-0995, CVE-2021-3156, CVE-2015-5287, CVE-2015-3246, CVE-2010-3904, and CVE-2022-0847.
The Linux attacks, like in the case, leverage various known vulnerabilities to obtain an initial foothold, followed by abusing various known Local Privilege Escalation (LPE) exploits to escalate to root, including CVE-2022-0995, CVE-2021-3156, CVE-2015-5287, CVE-2015-3246, CVE-2010-3904, and CVE-2022-0847.
The Linux attacks, like in the case, leverage various known vulnerabilities to obtain an initial foothold, followed by abusing various known Local Privilege Escalation (LPE) exploits to escalate to root, including CVE-2022-0995, CVE-2021-3156, CVE-2015-5287, CVE-2015-3246, CVE-2010-3904, and CVE-2022-0847.
The Linux attacks, like in the case, leverage various known vulnerabilities to obtain an initial foothold, followed by abusing various known Local Privilege Escalation (LPE) exploits to escalate to root, including CVE-2022-0995, CVE-2021-3156, CVE-2015-5287, CVE-2015-3246, CVE-2010-3904, and CVE-2022-0847.
Vulnérabilités exploitées (RCE) # CVE-2021-23758 : AjaxPro deserialization RCE
Vulnérabilités exploitées (RCE) # CVE-2021-29441 / CVE-2021-29442 : RCE dans le framework Nacos
Vulnérabilités exploitées (RCE) # CVE-2019-18935 : Deserialization .NET dans Telerik UI for ASP.NET AJAX
Vulnérabilités exploitées (RCE) # CVE-2021-29441 / CVE-2021-29442 : RCE dans le framework Nacos
Vulnérabilités exploitées (RCE) # CVE-2022-27925 : RCE non authentifié dans Zimbra Collaboration Suite
eSentire has recently observed active exploitation attempts targeting the WinSock File Transfer Protocol (WS_FTP) vulnerability CVE-2023-40044. Observed attacks resulted in the attempted deployment of the Metasploit payload Meterpreter and the adversary simulation tool Cobalt Strike. CVE-2023-40044 (CVSS: 10) is classified as a WS_FTP .NET Deserialization vulnerability in the Ad Hoc Transfer Module. Exploitation would allow an unauthenticated threat actor to achieve remote command execution on the underlying operating system of the WS_FTP Server.
35 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
On Linux systems, UAT-10147 exploits known privilege escalation vulnerabilities before deploying NoodleRAT, SPECTRE and Meterpreter.
The IOC corpus labels seven staged artifacts “Metasploit / Meterpreter (staged on C2)”.
Aside from the backdoors previously mentioned, this intrusion set also utilizes commonly used remote control tools like Cobalt Strike, PlugX, or Meterpreter stagers interchangeably in various attack stages.
Using the compromised account, the group reached additional hosts and installed meterpreter with scheduled-task persistence.
FIN10 has deployed Meterpreter stagers and SplinterRAT instances in the victim network after moving laterally.
IndigoZebra has acquired open source tools such as NBTscan and Meterpreter for their operations.
33 distinct techniques documented for this family, organized by ATT&CK tactic.
Tools SpicyOmelette, Cobalt Strike, Meterpreter, Mimikatz, CobtInt, ATMSpitter, Carbanak, Buhtrap, Cyst, Metasploit
Support command execution, command staging, direct x64 payloads, and external or in-process PowerShell payload delivery.
ImagingDevices.exe was launched via WmiPrivse.exe and a Meterpreter agent was injected into the process.
The Meterpreter `getsystem` command is described as attempting automatic privilege escalation to SYSTEM.
“The crypter includes a predefined 5-round shikata_ga_nai encoded Metasploit meterpreter bind payload.”
Azure user account downloaded bitmap.exe ... to execute an obfuscated, embedded malicious payload from its C2 server.
“its main purpose is to conceal the real identity and functionality of a payload from antivirus software” and the crypter encrypts the supplied payload using Camellia-256-CBC.
The content uses Meterpreter `hashdump`, Mimikatz `lsadump::sam`, Impacket `secretsdump.py`, and CrackMapExec `--sam` to obtain credentials.
The operator migrates into `lsass.exe`; alternatively, Task Manager is used to create an LSASS dump for offline reading with Minidump.
"Method 1": "GET" ... "Method 2": "POST" ... "Beacon Type": "8 (HTTPS)"
Industrial Spy ransomware actors use HTTP/HTTPS proxy via a C2 server to direct traffic to avoid direct connection.
The final payload is described as "windows/meterpreter/reverse_tcp" with a configured LHOST and LPORT.
335 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Java Meterpreter payload provided interactive access within the operator's automated Metasploit workflow. The resulting sessions supported command execution and follow-on activity, including account manipulation, privilege escalation, and Active Directory enumeration.
Post-exploitation payload deployed by UAT-10147 on compromised Linux systems after privilege escalation. Specific commands and capabilities used are not detailed.
Metasploit Meterpreter payloads were inadvertently collected from servers resembling Cobalt Strike Team Servers. These non-Cobalt Strike samples remain in the corpus for analysis and account for some early payloads that the Cobalt Strike parser could not parse. The reference does not describe their capabilities, targets, or operator attribution.
Named Metasploit-associated post-exploitation payload represented in the actor's staged tooling corpus. The source does not establish execution on compromised hosts or specify which payload capabilities were used.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.