Threat Intelligence Briefing

Observed threat activity decreased significantly, down 53.3% compared to the previous six-hour window. The vast majority of malicious activity (99%) continues to focus on SSH brute-force attacks. Globally, Romania (RO), China (CN), and the United States (US) are the top originating countries for observed attacks. Within the Nordic region, Sweden (SE) saw minimal activity, with a single IP address involved in SSH brute-forcing. No significant abuse of major hosting providers or Tor exit nodes was detected during this period. Given the SSH brute-force dominance, prioritize monitoring networks for unusual login attempts and credential stuffing. Pay close attention to traffic originating from RO, CN, and RU, particularly IPs similar to 45.140.17.124, 45.134.26.79, and 45.135.232.177, all linked to repeated SSH attacks. While HTTP DDoS and spam are currently low, maintain awareness for potential shifts in attack vectors.