Threat Intelligence Briefing

Threat activity surged, increasing 124.6% compared to the previous six-hour window, primarily driven by a significant uptick in global SSH brute-force attacks. A single SSH brute-force attack was observed originating from Sweden. The majority of activity appears to be emanating from residential IPs, with no significant concentration within specific hosting providers. Threat actors are heavily leveraging Russian and Romanian IPs, with IPs 45.135.232.177 and 2.57.121.25 showing the highest attack counts. No Tor exit node activity was observed. Given the surge in SSH brute-force attempts, prioritize monitoring networks originating from Russia (RU) and Romania (RO). Focus on ASNs associated with residential internet providers in those regions. Monitor for changes in brute-force techniques and payloads. Continue to track the IPs listed in the `top_ips` array as they may be re-used in future attacks.