Threat Intelligence Briefing

**Threat Landscape Right Now** Global threat activity rose 24.2% in the past 6 hours, driven by malware C2 (46% of attacks) and SSH bruteforce (43%), with notable spikes in Romania (RO), Netherlands (NL), and the US. No Nordic activity was detected. Key infrastructure includes high-volume attackers like 78.191.248.116 (18 malware C2 events) and 45.140.17.124 (12 bruteforce attempts from Russia). Dutch IPs (178.128.247.139, 161.35.144.148, 134.122.56.65) dominated SSH bruteforce, suggesting coordinated campaigns from NL-based datacenters. Tor exit nodes were inactive. **Tactical Intelligence** Monitor ASNs hosting repeat offenders, particularly Russian (45.140.17.124) and Dutch IPs, for SSH bruteforce patterns. Defenders should prioritize blocking NL datacenter subnets and inspecting traffic to malware C2 domains. No new CERT-EU advisories align with these trends, but the NL-centric SSH attacks warrant enhanced authentication controls. Emerging malware C2 infrastructure may shift to lesser-tracked providers