Threat Intelligence Briefing

Observed threat activity decreased by 22.2% globally compared to the prior 6-hour window. Suspicious activity continues to be the dominant threat category, comprising 74.6% of all reports. Botnet C2 activity remains elevated. Across the Nordic region, Sweden shows the highest activity with 7 unique IPs associated with severe abuse and suspicious activity. We also observed single instances of high threat activity in Norway and suspicious activity in Denmark. Monitor ASNs associated with recent botnet C2 activity, particularly those resolving to IPs 39.74.32.227 and 61.53.151.48. Focus on identifying potential compromised hosts within Nordic networks exhibiting similar behavior patterns to the global botnet C2 activity. Continue to prioritize detection of severe abuse and suspicious activity originating from Swedish and Finnish networks.