Threat Intelligence Briefing

Threat activity increased sharply, rising 51.4% compared to the previous six-hour period. The overwhelming majority of threats (99.6%) are SSH brute-force attacks, sourced primarily from Romania (RO). We observe a high concentration of attacks originating from datacenter IPs, notably from Romania. No significant activity was observed in Nordic countries during this period. No specific ISP or hosting provider is significantly impacted. No Tor exit node abuse was detected. Given the focus on SSH brute-force, monitor networks originating from Romania (RO) and Russia (RU), particularly ASNs hosting VPS infrastructure. Implement rate limiting and strong password policies on SSH services. Continue to monitor for shifts in attack vectors and the emergence of mail authentication brute-force attacks.