Threat Intelligence Briefing

Global threat activity increased sharply by 86.8% compared to the previous 6-hour period, with attacks and malware C2 being the most prevalent categories. The Netherlands (<a href="https://ip.wayscloud.services/country-intelligence/NL" target="_blank">NL</a>) remains the top source country, followed by the US and Canada. Nordic countries show stable activity, with Norway (<a href="https://ip.wayscloud.services/country-intelligence/NO" target="_blank">NO</a>) recording 18 events primarily in attacks and botnet-related traffic. Two Russian IPs (<a href="https://ip.wayscloud.services/ip-intelligence/45.140.17.124" target="_blank">45.140.17.124</a>, <a href="https://ip.wayscloud.services/ip-intelligence/45.135.232.92" target="_blank">45.135.232.92</a>) emerged as top threat sources, focusing on SSH brute-force attacks. This surge aligns with a known campaign active for the past 72 hours, not routine noise. Consider temporarily rate-limiting traffic from ASNs associated with the Russian and Vietnamese IP clusters, particularly targeting SSH services. Nordic defenders should maintain existing posture, as regional activity remains within expected baselines.