Threat Intelligence Briefing
Analysis period: 2026-01-14T12:00:01.951970 - 2026-01-14T18:00:01.951970 (6 hours)
Executive Summary
Global threat activity increased by 61.4% compared to the previous 6-hour period, with malware C2 and attack categories dominating. The Netherlands (<a href="https://ip.wayscloud.services/country-intelligence/NL" target="_blank">NL</a>) remains the top source country, accounting for 569 events, while Russia (<a href="https://ip.wayscloud.services/country-intelligence/RU" target="_blank">RU</a>) and Bulgaria (<a href="https://ip.wayscloud.services/country-intelligence/BG" target="_blank">BG</a>) show persistent SSH brute-force activity. Nordic countries remain stable, with Sweden (<a href="https://ip.wayscloud.services/country-intelligence/SE" target="_blank">SE</a>) seeing 24 events, consistent with its 7-day average. The top attacking IPs, including <a href="https://ip.wayscloud.services/ip-intelligence/45.135.232.92" target="_blank">45.135.232.92</a> (<a href="https://ip.wayscloud.services/country-intelligence/RU" target="_blank">RU</a>) and <a href="https://ip.wayscloud.services/ip-intelligence/5.187.35.21" target="_blank">5.187.35.21</a> (<a href="https://ip.wayscloud.services/country-intelligence/NL" target="_blank">NL</a>), are linked to known SSH brute-force campaigns. Consider temporary blocking or rate-limiting traffic from NL ASNs associated with SSH attacks, particularly those linked to historical brute-force patterns. Deprioritize isolated web attacks in Norway (<a href="https://ip.wayscloud.services/country-intelligence/NO" target="_blank">NO</a>) and Denmark (<a href="https://ip.wayscloud.services/country-intelligence/DK" target="_blank">DK</a>), as they align with routine background noise.