Threat Intelligence Briefing

Threat activity has decreased by 57.5% compared to the previous six-hour window, with a focus on suspicious activity (75%). Nordic countries saw minimal activity, accounting for less than 1% of total threats, primarily categorized as suspicious activity. The top global threat categories include malware command and control activities (16%) alongside severe abuse reports (5%). No specific ISP or hosting providers were significantly targeted during this period. Given the prevalence of malware C2 activity, monitor IPs 45.64.246.16, 101.43.58.190 and 154.198.50.152 closely. Botnet C2 activity was also noted, requiring monitoring of IPs 162.243.103.246 and 137.184.9.29. Given CERT-EU advisory 2025-037 regarding F5 product vulnerabilities and potential nation-state exploitation, monitor for related activity targeting F5 infrastructure.