Threat Intelligence Briefing

Threat activity surged 54.6% in the last 6 hours, driven by a spike in suspicious activity reports. Nordic countries saw limited activity, with Finland (8 reports, SSH brute force) and Sweden (5 reports, severe abuse) leading. No specific ISPs were targeted in the region. Globally, attacks are primarily datacenter-based, given the nature of botnet C2 and malware C2 activity observed. We see no significant Tor exit node abuse in this period. Monitor ASNs hosting IPs 23.177.185.39 (malware C2) and 45.140.17.124 (SSH brute force) for further activity. The increase in "suspicious_activity" needs deeper investigation to determine if it correlates with recent F5 product vulnerabilities disclosed in CERT-EU advisory 2025-037, given reports of nation-state actor compromise and potential source code leaks. Focus on detecting post-exploitation behavior on F5 devices.