Threat Intelligence Briefing

Global threat activity remains stable with a +2.1% increase compared to the previous 6-hour period, consistent with the 7-day average. Malware C2 (1,192 events) and attacks (609) dominate, primarily originating from Germany (513), the Netherlands (349), and the US (239). Nordic countries show minimal activity (3 events in Sweden, 2 in Finland and Norway), all involving SSH brute force and attacks—no deviation from baseline. The top threat IPs (e.g., <a href="https://ip.wayscloud.services/ip-intelligence/45.135.232.92" target="_blank">45.135.232.92</a>/RU, <a href="https://ip.wayscloud.services/ip-intelligence/159.65.201.160" target="_blank">159.65.201.160</a>/NL) exhibit repetitive SSH brute-forcing patterns, suggesting automated campaigns rather than targeted attacks. Given the stable volume, prioritize monitoring known malicious ASNs (e.g., Dutch and Russian hosting providers) for SSH brute-force clusters. Deprioritize individual IP blocking unless they exceed rate limits, as these are likely ephemeral.