Threat Intelligence Briefing

The overall threat landscape has decreased by 10.4% in the last 6 hours, with a strong concentration on SSH brute-force attacks. While no specific Nordic countries were targeted, global activity remains focused on attacking datacenters. Top attacking countries include China, Russia, and the US. We observed no significant Tor exit node activity. No specific ISP or hosting provider emerged as a primary target. Given the prevalence of SSH brute-force attacks, we recommend defenders closely monitor network traffic for suspicious login attempts and unusual authentication patterns. Focus on known malicious networks, particularly those originating from Russia (ASNs belonging to IPs: 45.134.26.79, 45.135.232.177, 45.140.17.124) and Iran (ASN belonging to IP: 62.60.131.157). Continue to prioritize credential stuffing detection and multi-factor authentication implementation.