Threat Intelligence Briefing

Global threat activity increased by 116.4% compared to the previous 6-hour period, with malware C2 (697 events) and attacks (547 events) dominating. The Netherlands (505 events) remains the top source, followed by the US and China. Nordic countries show minimal activity (4 events in Norway, 2 in Finland/Sweden), consistent with their typical low baseline. Notably, Vietnamese IPs <a href="https://ip.wayscloud.services/ip-intelligence/116.110.20.185" target="_blank">116.110.20.185</a>/187 and Dutch IPs <a href="https://ip.wayscloud.services/ip-intelligence/142.93.132.127" target="_blank">142.93.132.127</a>/<a href="https://ip.wayscloud.services/ip-intelligence/188.166.20.38" target="_blank">188.166.20.38</a> are conducting coordinated SSH brute-force attacks, suggesting a campaign rather than isolated incidents. Given the surge in SSH-related attacks, consider temporary rate-limiting for traffic from ASNs associated with these IP clusters, particularly from NL and VN. Routine web attacks in Nordic regions do not warrant immediate action, but monitoring for escalation is advised.