Back Redpacketsecurity

Cobalt Strike Beacon Detected – 154[.]12[.]94[.]16:2087

Redpacketsecurity •admin • September 9, 2026

The Information provided at the time of posting was detected as “Cobalt Strike”. Depending on when you are viewing this article, it may no longer be the case and could be determined as being a false positive. Please do your own additional validation. – RedPacket Security TimeStamp 2026-09-09T12:38:58.792865

Cobalt Strike Beacon Information

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Cobalt Strike Beacons Detected on Various Ports On September 9, 2026, multiple instances of Cobalt Strike beacons were detected across various IP addresses and ports. The affected IPs include 196.251.121.183:4433, 14.225.212.124:30005, 154.12.94.16:2087, 137.220.151.95:8888, 27.71.16.98:443, and 119.45.160.160:8889. Cobalt Strike is a well-known penetration testing tool often misused by threat actors for malicious purposes. The articles caution that the detections may be false positives and recommend further validation. The current status of these detections remains uncertain, with no specific details on the scope of impact or targeted organizations. Security professionals are advised to monitor their networks for these indicators of compromise (IOCs). 6 sources 34

Extracted Entities

Cobalt Strike Beacon Detected – 154[.]12[.]94[.]16:2087

The full story

Extracted Entities

IP Addresses (1)

Malware (1)

Tools (1)