Meterpreter: New indicators of compromise

ThreatFox has published new indicators of compromise (IOCs) related to the Meterpreter post-exploitation framework, specifically categorized as Windows payloads. These indicators were observed between 04:56 and 14:34 UTC on November 4, 2026, and were reported by the community contributors Grim and Tuxxin. Meterpreter is commonly utilized by threat actors for post-exploitation activities, including command-and-control, privilege escalation, and lateral movement.

Impact

Successful deployment of Meterpreter on an endpoint allows an attacker to maintain persistent, interactive access to the affected system, enabling file system navigation, process manipulation, and the exfiltration of sensitive data.

Recommendation

• Implement file integrity monitoring and scan endpoints for the provided hashes.
• Configure SIEM or EDR solutions to trigger alerts on the execution of files matching the provided SHA-256 or MD5 hashes.
• Review historical endpoint telemetry for any execution activity associated with these specific file identifiers.