Threat Intelligence Briefing

Observed threat activity increased 54.6% compared to the prior 6-hour period, driven primarily by suspicious activity. The majority of threats originated from datacenters. Within the Nordic region, Finland experienced the most activity with 8 unique IPs primarily engaged in SSH brute-forcing and suspicious activity. Sweden followed with 5 IPs showing severe abuse and suspicious activity. No significant Tor exit node activity was observed. Monitor networks exhibiting SSH brute-force activity, particularly those originating from Russia (ASN data needed). The surge in suspicious activity warrants further investigation to determine the underlying cause. Given the prevalence of botnet C2 activity, prioritize detection and mitigation of infected hosts. Evaluate internal exposure to CVEs addressed in recent CERT-EU advisories for FortiOS, Veeam, and F5 products, and implement recommended mitigations.