Back Redpacketsecurity

Empire C2 Detected – 138[.]124[.]62[.]43:443

Redpacketsecurity •admin • October 8, 2026

The Information provided at the time of posting was detected as “Empire C2”. Depending on when you are viewing this article, it may no longer be the case and could be determined as being a false positive. Please do your own additional validation. – RedPacket Security TimeStamp 2026-10-06T20:53:31.556651

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New C2 Servers Detected: Sliver and Empire Recent reports detail the detection of two command-and-control (C2) servers: Sliver C2 at IP 152.42.207.101 on port 31337 and Empire C2 at IP 138.124.62.43 on port 443. The Sliver C2 was identified on October 4, 2026, while the Empire C2 was reported on October 6, 2026. Both detections come with a caution that they may be false positives and require further validation. No specific vulnerabilities, CVEs, or exploitation details were provided in the articles. The potential impact and scope of these C2 servers remain unclear, as further investigation is needed. Security professionals are advised to monitor their networks for these indicators of compromise (IOCs). 2 sources 24

Extracted Entities

IP Addresses (1)

138.124.62.43

Malware (1)

Empire C2