Redpacketsecurity Multiple Cobalt Strike Beacons Detected on Various Ports
Article Content
- •Multiple Cobalt Strike beacons detected on September 9, 2026.
- •Affected IPs include 196.251.121.183, 14.225.212.124, and others.
- •Cobalt Strike is frequently misused by threat actors.
On September 9, 2026, multiple instances of Cobalt Strike beacons were detected across various IP addresses and ports. The affected IPs include 196.251.121.183:4433, 14.225.212.124:30005, 154.12.94.16:2087, 137.220.151.95:8888, 27.71.16.98:443, and 119.45.160.160:8889. Cobalt Strike is a well-known penetration testing tool often misused by threat actors for malicious purposes. The articles caution that the detections may be false positives and recommend further validation. The current status of these detections remains uncertain, with no specific details on the scope of impact or targeted organizations. Security professionals are advised to monitor their networks for these indicators of compromise (IOCs).
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (22)
Following this threat?
Track Cobalt Strike in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
CyberXero Campaign Targets Ukrainian Records Using AI Tools CyberXero, a Russian-speaking initial access broker, has launched a dual-pronged campaign targeting WordPress sites and Ukrainian critical infrastructure, leveraging AI tools like Claude Code. The operation has led to the exfiltration of over 628,000 records from Ukrainian entities, with confirmed compromises in… 
Ransomware Groups Exploit Palo Alto VPN Flaw CVE-2026-0257 Ransomware groups Qilin and INC are exploiting CVE-2026-0257, a vulnerability in Palo Alto Networks' PAN-OS GlobalProtect VPN, to bypass authentication and gain unauthorized access to corporate networks. Despite a security patch released in May 2026, attackers have been exploiting this flaw since June, allowing them…