Threat Intelligence Briefing

Global threat activity changed by several orders of magnitude (3,317 → 31,594 events), with malware C2 traffic dominating (17,658 events). China (<a href="https://ip.wayscloud.services/country-intelligence/CN" target="_blank">CN</a>) remains the top source, accounting for 49.6% of observed threats. Nordic activity remains stable, with Sweden (<a href="https://ip.wayscloud.services/country-intelligence/SE" target="_blank">SE</a>) showing the highest volume (151 events), primarily attacks and botnet-related traffic. The surge aligns with known malware campaigns active since early January, indicating coordinated infrastructure activation rather than ephemeral noise. Focus on Chinese ASNs hosting malware C2 nodes, as these clusters exhibit persistent patterns. Temporary rate-limiting for traffic from CIDR ranges associated with top malicious IPs (e.g., <a href="https://ip.wayscloud.services/ip-intelligence/113.45.19.0" target="_blank">113.45.19.0</a>/24) is advised, particularly for enterprises with exposure to Asian markets. Deprioritize individual IP blocking unless tied to recurring attack patterns.