Threat Intelligence Briefing

Threat activity surged 27% globally in the last 6 hours, driven primarily by malware C2 (45% of attacks) and SSH brute-forcing (43%), with notable concentration in the Netherlands, Romania, and the US. No Nordic-specific threats were observed. Attack infrastructure skewed heavily toward datacenter IPs, particularly from DigitalOcean (AS14061) and Hetzner (AS24940), with Russian IP <a href="https://ip.wayscloud.services/ip-intelligence/45.140.17.124" target="_blank">45.140.17.124</a> standing out for blended brute-force activity. The absence of Tor exit nodes suggests actors are relying on conventional hosting providers. Top malicious IPs like <a href="https://ip.wayscloud.services/ip-intelligence/78.191.248.116" target="_blank">78.191.248.116</a> (18 malware C2 events) exhibit high-volume targeting, though attribution remains unclear due to missing geolocation data. Defenders should prioritize blocking AS24940 and AS14061 subnets exhibiting SSH brute-forcing patterns, especially on non-standard ports. The malware C2 spike warrants deeper inspection of outbound traffic to Dutch and Romanian IP ranges. While no new CERT-EU advisories align with these threats, the resurgence of SSH attacks mimicking legitimate cloud traffic requires enhanced credential hygiene and MFA enforcement. Monitor AS60404 (DigitalOcean NL) for emerging C2 infrastructure.