Threat Intelligence Briefing

Global threat activity increased by 12.3% in the last 6 hours, with 1,233 incidents across 84 countries. The US (365 attacks), China (120), and the Netherlands (77) were top sources, with severe abuse constituting 100% of threats. Nordic countries saw 20 attacks, primarily from Norway (10) and Sweden (8), all classified as severe abuse. Notably, South Korean IPs <a href="https://ip.wayscloud.services/ip-intelligence/1.241.64.92" target="_blank">1.241.64.92</a>, <a href="https://ip.wayscloud.services/ip-intelligence/1.244.246.221" target="_blank">1.244.246.221</a>, and <a href="https://ip.wayscloud.services/ip-intelligence/1.250.134.55" target="_blank">1.250.134.55</a> were active, alongside Taiwanese and Chinese infrastructure. No Tor exit nodes were detected. Monitor these IPs closely, as they exhibit persistent severe abuse patterns. Focus on blocking Korean and Chinese IP ranges showing repeated malicious activity. Nordic networks should prioritize reviewing logs for connections to these high-risk IPs, especially from datacenter environments lacking legitimate traffic patterns.