Threat Intelligence Briefing

Global threat activity increased by 55.1% vs the previous period, with malware C2 (788 events) and attacks (545) dominating. The Netherlands (422) and US (220) remain primary sources, while Nordic activity remains low (SE:7, NO:2). SSH brute force clusters from Bulgaria (<a href="https://ip.wayscloud.services/ip-intelligence/195.178.110.30" target="_blank">195.178.110.30</a>) and Russia (<a href="https://ip.wayscloud.services/ip-intelligence/45.135.232.92" target="_blank">45.135.232.92</a>) show sustained patterns. This surge exceeds typical weekend baselines, suggesting coordinated activity rather than background noise. Consider temporary rate-limiting for CIDR ranges associated with recurring SSH brute force patterns, particularly from ASNs in NL/BG/RU. Deprioritize isolated web attacks in Nordic regions, which align with historical baselines.