Threat Intelligence Briefing

Global threat activity increased by 43.1% vs the previous 6-hour period, with malware C2 (996 events) and attacks (582) driving the surge. The Netherlands (379 events) and US (289) remain top sources, while Nordic activity remains stable (Sweden: 11 events, Finland: 5). Two Russian IPs (<a href="https://ip.wayscloud.services/ip-intelligence/176.120.22.47" target="_blank">176.120.22.47</a>/13) from the same /24 subnet accounted for 24 brute-force attempts, indicating potential coordinated activity rather than isolated incidents. SSH-related threats now represent 20.6% of total events, up from 15% in the prior period. Given the sustained brute-force patterns, consider temporarily rate-limiting SSH traffic from ASN 48347 (Russia) and 20857 (Netherlands). Prioritize monitoring for credential stuffing attempts, particularly against cloud infrastructure. Deprioritize individual IP blocking unless part of clustered /24 ranges.