Threat Intelligence Briefing

Global threat activity surged by several orders of magnitude (2,152 → 17,279 events), with spam (5,444 events) and attacks (3,342) dominating. The US (4,330), Netherlands (2,127), and India (1,097) were top sources. Nordic activity remained stable, with Sweden (75 events) and Finland (61) showing typical patterns. The spike aligns with a known botnet campaign (active since January 18), evidenced by C2 IPs like <a href="https://ip.wayscloud.services/ip-intelligence/161.97.112.116" target="_blank">161.97.112.116</a> (France) and <a href="https://ip.wayscloud.services/ip-intelligence/193.233.248.201" target="_blank">193.233.248.201</a> (Russia). This is not routine noise but a coordinated escalation. Consider temporary rate-limiting for ASNs historically linked to this campaign, particularly those hosting C2 infrastructure. Deprioritize individual IP blocking unless they exhibit sustained malicious patterns. Focus on clusters from NL and RU ASNs, which show abnormal SSH brute-force activity.