Threat Intelligence Briefing

Global threat volume increased by 31.4% compared to the previous 6-hour period, representing a significant deviation from typical baseline activity. This surge is primarily driven by SSH brute-force attacks, with clusters originating from ASNs in Russia (<a href="https://ip.wayscloud.services/ip-intelligence/176.120.22.0" target="_blank">176.120.22.0</a>/24) and Bulgaria. Nordic activity remains stable and within expected parameters; Finland observed 14 events across its usual categories, while Sweden and Norway showed minimal activity consistent with their low baselines. The concentration of attacks on SSH services indicates a coordinated campaign rather than random noise. Defenders should prioritize blocking the /24 CIDR ranges associated with the Russian and Bulgarian SSH brute-force clusters, as these represent persistent patterns. Consider implementing temporary rate-limiting on SSH authentication attempts globally. Routine web attacks and individual IPs from the Nordics can be deprioritized, as they align with normal background traffic.