Threat Intelligence Briefing

Global threat activity increased by 48.5% compared to the previous 6-hour period, with malware C2 (722 events) and attacks (558 events) dominating. The Netherlands (323 events) and Russia-linked IP <a href="https://ip.wayscloud.services/ip-intelligence/45.135.232.92" target="_blank">45.135.232.92</a> (15 attacks) were particularly active. Nordic countries remained stable with Sweden (8 events) showing routine brute force and spam activity. The surge aligns with known SSH brute force campaigns active since mid-December, not requiring immediate escalation. Consider temporary rate-limiting for Dutch ASNs (evident in 3 of top 5 attack IPs) and monitoring Russian CIDR ranges associated with sustained SSH attacks. Deprioritize individual IPs in favor of pattern-based blocking given the campaign-driven nature of this activity.