Threat Intelligence Briefing

Global threat activity changed by several orders of magnitude (1,953 → 18,021 events), with spam, attacks, and malware C2 dominating. The US, Netherlands, and China remain top sources, but the spike suggests coordinated activity rather than routine noise. Nordic countries show stable patterns, with Sweden (73 events) and Finland (64) seeing typical anonymizer and brute-force attempts. Norway and Denmark remain low (18 and 16 events respectively), consistent with their 7-day averages. The top malicious IPs (e.g., <a href="https://ip.wayscloud.services/ip-intelligence/5.187.35.21" target="_blank">5.187.35.21</a>, NL) cluster around SSH brute-forcing, indicating a targeted campaign rather than isolated probes. Given the global surge, prioritize reviewing SSH access controls and rate-limiting traffic from ASNs hosting repeat offenders (particularly NL and RU ranges). Deprioritize individual IP blocks unless they exhibit sustained patterns across multiple reporting periods.