Threat Intelligence Briefing

Global threat volume changed by several orders of magnitude (2,014 → 16,260 events), representing a severe deviation from the previous period. This surge is primarily driven by attacks, spam, and malware C2 traffic, with notable contributions from the US (3197) and Netherlands (3021). Nordic activity remains relatively stable and routine; Sweden (82 events) and Finland (50) show typical scanning and brute-force patterns consistent with their baselines. The top threat IPs are predominantly SSH brute-forcers from RO, BG, and NL ASNs. Given the global surge, consider temporarily rate-limiting or blocking traffic from CIDR ranges associated with the top contributing ASNs in the US and NL, which are the primary sources of the anomalous volume. Nordic defenders should maintain existing perimeter controls as regional activity is within expected parameters. Prioritize investigation into the increased global C2 and attack traffic.