Threat Intelligence Briefing

Global threat activity increased by 18.9% compared to the previous 6-hour period, primarily driven by malware C2 (491 events) and attack traffic (477 events). The Netherlands (278 events) and US (212) remain top origin countries, while Nordic activity remained stable (7 events in Sweden, 6 in Norway). Two Russian IPs (<a href="https://ip.wayscloud.services/ip-intelligence/45.140.17.124" target="_blank">45.140.17.124</a>, <a href="https://ip.wayscloud.services/ip-intelligence/45.135.232.92" target="_blank">45.135.232.92</a>) emerged as persistent SSH brute-forcers, accounting for 23 attacks combined. SSH brute-force remains the dominant attack vector in the region. Consider temporary rate-limiting for traffic from Russian ASNs historically linked to SSH attacks, particularly targeting port 22. Nordic web attacks remain at baseline levels; no immediate action required beyond standard monitoring for Norway's web-facing services.