Threat Intelligence Briefing

Global threat activity surged 24.7% in the last 6 hours, driven primarily by malware C2 infrastructure (314 incidents) and SSH brute-force attacks (297 incidents), with notable concentration in Romania (51), the Netherlands (48), and Singapore (43). Attackers heavily leveraged datacenter IPs, with key malicious infrastructure observed at 78.191.248.116 (18 malware C2 incidents) and Russian-hosted 45.140.17.124 (11 brute-force attempts). Nordic regions showed no significant activity. The threat landscape remains dominated by automated credential attacks, with 85% of incidents targeting SSH services across multiple geographies. No Tor exit node activity was detected. Defenders should prioritize blocking ASNs hosting repeat offenders, particularly Russian and Dutch networks associated with brute-force campaigns. The 78.191.248.116 malware C2 node requires immediate blacklisting. SSH hardening remains critical—implement rate-limiting and geo-blocking for high-risk regions (RO, NL, RU). Monitor for increased malware C2 activity blending with credential attacks, as this dual-threat pattern is gaining traction. No Nordic-specific countermeasures are currently required.