Threat Intelligence Briefing

Threat activity surged 26% globally in the past 6 hours, driven primarily by malware C2 (45% of incidents) and SSH brute-forcing (43%), with notable concentration in the Netherlands (53 attacks), Romania (52), and the US (44). Nordic-specific threats remained absent, but infrastructure patterns show Russia-linked IP <a href="https://ip.wayscloud.services/45.140.17.124" target="_blank">45.140.17.124</a> conducting 11 brute-force attacks, alongside Bulgarian (<a href="https://ip.wayscloud.services/195.178.110.30" target="_blank">195.178.110.30</a>) and Dutch (<a href="https://ip.wayscloud.services/178.128.247.139" target="_blank">178.128.247.139</a>, <a href="https://ip.wayscloud.services/161.35.144.148" target="_blank">161.35.144.148</a>) nodes. No Tor exit activity was detected. The top attacking IP, <a href="https://ip.wayscloud.services/78.191.248.116" target="_blank">78.191.248.116</a> (18 malware C2 incidents), lacked geolocation but displayed patterns consistent with compromised residential proxies, while Dutch IPs suggest potential Hetzner or Leaseweb abuse. Defenders should prioritize monitoring ASNs linked to Dutch and Russian brute-forcing, particularly networks hosting high-volume SSH attacks. Malware C2 infrastructure shows signs of rapid IP rotation, indicating possible bulletproof hosting abuse. Implement strict SSH rate-limiting and inspect traffic from NL (AS14061, AS60404) and RU (AS20485) networks. Emerging brute-force clusters targeting cloud instances warrant