Threat Intelligence Briefing

Global threat activity changed by several orders of magnitude (1,487 → 19,729 events), with malware C2 (5,132 events) and spam (4,512) dominating. The US (4,232) and China (2,321) remain top originators, but Singapore (833) shows unusual concentration in malware C2 via <a href="https://ip.wayscloud.services/ip-intelligence/47.236.0.0" target="_blank">47.236.0.0</a>/16 and <a href="https://ip.wayscloud.services/ip-intelligence/47.251.0.0" target="_blank">47.251.0.0</a>/16 subnets. Nordic activity remains stable compared to the 7-day average, with Sweden (44 events) and Finland (36) seeing routine scanning and brute-force attempts. No new campaigns emerged. Prioritize monitoring Singaporean ASNs for malware C2 patterns, which show sustained infrastructure reuse. Deprioritize individual IPs in Nordic brute-force attempts, as these match historical noise. Consider temporary rate-limiting for /16 blocks in SG-originating traffic.