Meterpreter

Meterpreter is a type of malware that is part of the Metasploit penetration testing software. It serves as an attack payload and provides an interactive shell, allowing threat actors to control and execute code on a compromised system. Advanced Persistent Threat (APT) actors have created and used a variant of this malware on the ServiceDesk system, where it is listed as wkHPd.exe. Meterpreter allows for the execution of code in memory, giving the threat actor control over the infected system and enabling them to exploit the internal network of an organization using various features offered by the malware. The malware has been deployed by attackers after successful exploitation of systems, establishing communication through reverse TCP connections to their infrastructure. The threat actor can install Meterpreter Stager, a type of module that acts as a malicious backdoor, with the installation method determining the module type. Meterpreter is akin to the Beacon tool in Cobalt Strike, another prominent offensive security tool. Other notable tools include Viper, AsyncRAT, QuasarRAT, PlugX, ShadowPad, and DarkComet. Researchers from AhnLab Security Intelligence Center (ASEC) highlighted that attackers are likely exploiting inappropriate settings or vulnerabilities present in Redis implementations to distribute Meterpreter for nefarious purposes. In particular, an 8-year-old version of the Redis open-source database server is being used to expose exploits within a system, potentially allowing for full system takeover and distribution of other malware. Furthermore, some installers have been found to carry a malicious Python payload that, when launched, pulls down a Meterpreter remote shell and Cobalt Strike beacons.