Threat Intelligence Briefing

Global threat activity decreased by 93.7% compared to the previous period, with 1,134 events observed. SSH brute-force attacks remain the dominant category, accounting for 237 incidents, primarily from IPs in the US, Netherlands, and Russia. Nordic countries show minimal activity, with Sweden recording 7 events across 3 IPs, consistent with baseline levels. The top malicious IPs, such as <a href="https://ip.wayscloud.services/ip-intelligence/45.140.17.124" target="_blank">45.140.17.124</a> (<a href="https://ip.wayscloud.services/country-intelligence/RU" target="_blank">RU</a>) and <a href="https://ip.wayscloud.services/ip-intelligence/5.187.35.21" target="_blank">5.187.35.21</a> (<a href="https://ip.wayscloud.services/country-intelligence/NL" target="_blank">NL</a>), are linked to sustained SSH brute-force campaigns active for weeks. This decline likely reflects normal diurnal patterns rather than a strategic shift. Given the persistence of SSH brute-force attacks, consider temporarily blocking or rate-limiting traffic from ASNs associated with these IPs, particularly those in Russia and the Netherlands. Deprioritize individual IP monitoring in favor of pattern-based defenses, as these campaigns rotate IPs frequently.