Threat Intelligence Briefing

Global threat activity doubled (+99.3%) compared to the previous 6-hour period, with malware C2 traffic (725 events) dominating. The Netherlands (<a href="https://ip.wayscloud.services/country-intelligence/NL" target="_blank">NL</a>) accounted for 20% of all threats, primarily from SSH brute force attacks originating from ASNs like <a href="https://ip.wayscloud.services/ip-intelligence/5.187.35.21" target="_blank">5.187.35.21</a> and <a href="https://ip.wayscloud.services/ip-intelligence/188.166.44.48" target="_blank">188.166.44.48</a>. Nordic countries remained stable, with Sweden (6 events) showing routine SSH and web attack patterns consistent with its 7-day average. The spike in global activity correlates with known Mirai botnet infrastructure reactivation. Consider temporary rate-limiting for SSH traffic from NL-based CIDR ranges <a href="https://ip.wayscloud.services/ip-intelligence/5.187.0.0" target="_blank">5.187.0.0</a>/16 and <a href="https://ip.wayscloud.services/ip-intelligence/188.166.0.0" target="_blank">188.166.0.0</a>/16, where 43% of brute force attempts originated. Prioritize monitoring for web attack patterns in DK/FI, though current volumes don't justify immediate action.