Threat Intelligence Briefing

The global threat landscape is more active, with overall threat reports increasing by 21.8% compared to the previous 6-hour window. SSH brute-force attacks dominate, accounting for 91% of all reported threats, with mail authentication brute-force attempts making up most of the remainder. Romania, the United States, and Russia are the top originating countries for malicious activity. No significant attack patterns were observed targeting Nordic countries specifically. No specific ISPs or hosting providers are standing out as heavily attacked or abused in this period. Given the prevalence of SSH brute-force attacks originating from networks in Romania, Ukraine, and Russia, defenders should prioritize monitoring traffic from ASNs geolocated to these countries. We advise carefully analyzing SSH logs for anomalous login attempts and unusual activity post-authentication. Consider implementing rate limiting and multi-factor authentication for SSH services where feasible. Monitor IPs 45.135.232.177, 45.134.26.79, 193.46.255.217, 185.156.73.233, and 193.46.