Threat Intelligence Briefing

Global threat volume deviated significantly from the previous period, showing a 92.2% decrease. This sharp reduction is atypical and suggests a potential lull in coordinated activity or a shift in attacker infrastructure. Nordic activity remained low and routine; Sweden (10 events) and Finland (3) saw common SSH and web attack patterns, while Norway registered a single, isolated web attack, all consistent with their established baselines. The top threat actors, primarily from Turkmenistan and Bulgaria, continued SSH brute-force campaigns that have been active for weeks. Focus on monitoring SSH authentication attempts from known malicious ASNs rather than individual IPs, as this pattern persists. Consider maintaining existing rate-limiting rules on SSH services, as the overall decrease does not indicate a reduced risk from these ongoing campaigns.