Threat Intelligence Briefing

Global threat activity increased by 74.3% compared to the previous 6-hour period, with attacks and malware C2 comprising nearly 50% of observed events. The Netherlands (ASN 20473, 206067) remains the top source, with Russian IP <a href="https://ip.wayscloud.services/ip-intelligence/176.120.22.47" target="_blank">176.120.22.47</a> notably active in SSH brute-forcing. Nordic activity remains stable, with Sweden seeing routine botnet and SSH attempts (14 events from 9 IPs), while Norway and Finland show baseline noise. This surge aligns with a known Mirai-variant campaign targeting SSH services, active since January 12. Prioritize monitoring for clustered SSH brute-forcing from Dutch and Russian CIDRs (e.g., <a href="https://ip.wayscloud.services/ip-intelligence/188.166.116.0" target="_blank">188.166.116.0</a>/24), particularly against cloud infrastructure. Rate-limiting SSH connections from these ASNs is recommended, while Swedish web attacks remain within expected thresholds.