Threat Intelligence Briefing

The threat landscape has intensified significantly, with overall threat reports surging 147.4% compared to the previous six-hour window. Globally, malware command and control activity accounts for the bulk of the malicious activity. Observed attacks are primarily emanating from China and Russia. Limited activity targeting Nordic countries was observed, with single SSH brute-force attacks originating towards Norway and Sweden. No significant ISP or hosting provider abuse was noted in the region, and no Tor exit node activity was detected in the Nordic countries. Given the rise in brute-force attacks, particularly from Russian networks, monitor ASNs associated with IP ranges 45.135.0.0/16 and 45.140.0.0/16. Prioritize detection rules focused on SSH brute-force and malware C2 communications. Track IP addresses 196.251.116.84, 150.40.127.100 and 147.185.221.212, due to their high attack counts and suspected botnet/malware C2 involvement.