Threat Intelligence Briefing

Global threat volume increased by 21.1% compared to the previous 6-hour period, a significant deviation from the 7-day average. The primary driver is a surge in malware C2 activity (828 events), alongside sustained SSH brute-force campaigns. Nordic activity remains low; Norway's 13 events are routine for its baseline. The top threat IPs, predominantly from RU, TM, and VN, are part of a known, persistent SSH brute-force cluster active for weeks, not a new campaign. Focus on the pattern, not the ephemeral IPs. Consider implementing temporary network-layer rate limiting for SSH traffic originating from ASNs historically associated with these brute-force campaigns, particularly from Eastern Europe and Southeast Asia. Deprioritize individual IP blocking as the infrastructure rotates rapidly.