Threat Intelligence Briefing

Threat activity dropped sharply by 85.6% compared to the previous 6-hour period, aligning with typical weekend patterns. Malware C2 remains the dominant category (1,161 events), followed by SSH brute force activity concentrated in Russia (<a href="https://ip.wayscloud.services/ip-intelligence/176.120.22.0" target="_blank">176.120.22.0</a>/24) and the Netherlands (<a href="https://ip.wayscloud.services/ip-intelligence/164.92.157.197" target="_blank">164.92.157.197</a>, <a href="https://ip.wayscloud.services/ip-intelligence/104.248.204.137" target="_blank">104.248.204.137</a>). Sweden saw minimal activity (9 events), consistent with its 7-day average. The Russian IP cluster (176.120.22.x) shows sustained brute force attempts over the past 72 hours, distinguishing it from ephemeral scanners. Consider temporary rate-limiting for SSH traffic from <a href="https://ip.wayscloud.services/asn-intelligence/49505" target="_blank">AS49505</a> (Russia) and <a href="https://ip.wayscloud.services/asn-intelligence/20473" target="_blank">AS20473</a> (Netherlands), where 45% of brute force events originated. Deprioritize individual IP blocking unless repeated patterns match known campaign TTPs. No TOR exit nodes were observed.