Threat Intelligence Briefing

Global threat activity changed by several orders of magnitude (1,777 → 16,742 events), with spam (4,616 events) and attacks (3,634 events) dominating. The US (3,444), Netherlands (1,819), and China (1,124) were top sources. Nordic activity remained stable, with Sweden (60 events) showing expected anonymizer and botnet C2 patterns. The spike is attributed to a surge in SSH brute-force attacks, notably from Russian (<a href="https://ip.wayscloud.services/ip-intelligence/45.140.17.124" target="_blank">45.140.17.124</a>) and Dutch (<a href="https://ip.wayscloud.services/ip-intelligence/164.90.199.63" target="_blank">164.90.199.63</a>) IPs, consistent with a week-long campaign targeting weak credentials. Defender actions should prioritize rate-limiting SSH traffic from ASNs historically linked to brute-force clusters, particularly in Russia and the Netherlands. Deprioritize individual IP blocking unless part of known CIDR ranges. Temporary geo-blocking of high-risk regions may reduce noise.