Threat Intelligence Briefing

Global threat activity has changed by several orders of magnitude (2,396 → 14,746 events), representing a severe deviation from typical baseline volumes. This surge, approximately 515% above the previous period, is dominated by spam, attacks, and malware C2 traffic, primarily originating from the US, Netherlands, and China. Nordic activity remains stable and routine; Sweden (59 events) and Finland (44) show expected, low-volume noise across their usual categories like brute force and scanning. The top attacking IPs are concentrated on SSH brute force campaigns from ASNs in Russia, Germany, and the Netherlands. Given the global surge is not routine, consider temporarily blocking or rate-limiting traffic from the /16 CIDR ranges associated with the top-source Netherlands (ASN 14061) and US (ASN 14618) providers. Nordic defenders can deprioritize local events as they align with historical baselines.