Threat Intelligence Briefing

Global threat activity increased by 65.5% compared to the previous 6-hour period, with malware C2 (475 events) and attacks (390 events) dominating. The Netherlands (478 events) and Russia-linked IPs (<a href="https://ip.wayscloud.services/ip-intelligence/45.140.17.124" target="_blank">45.140.17.124</a>, <a href="https://ip.wayscloud.services/ip-intelligence/45.135.232.92" target="_blank">45.135.232.92</a>) were particularly active in SSH brute-force campaigns. Nordic countries showed stable, low-volume activity (7 events in FI/SE, 4 in NO, 3 in DK), consistent with regional baselines. The surge in Dutch-hosted threats suggests possible infrastructure reuse by known actors. Consider temporary rate-limiting for /24 ranges hosting repeated SSH brute-force attempts (e.g., <a href="https://ip.wayscloud.services/ip-intelligence/146.190.236.0" target="_blank">146.190.236.0</a>/24). Deprioritize individual IP blocking for low-volume web attacks in Nordic regions unless patterns escalate.