Threat Intelligence Briefing

Observed threat activity has decreased 30.2% compared to the previous six-hour period, with a total of 180 threats originating from 135 unique IPs globally. SSH brute-force attempts continue to dominate, accounting for 98% of all observed attacks. Within the Nordic region, Sweden experienced minimal activity, with only one reported SSH brute-force attack. Top attacking countries remain consistent: China, Romania, and Russia. No significant abuse of specific ISPs or hosting providers was detected during this period, and no activity was observed from Tor exit nodes. Given the persistent SSH brute-force activity, defenders should prioritize hardening SSH configurations and monitoring for suspicious login attempts. Specifically, monitor networks originating from Russia (ASNs belonging to the RU TLD) and Romania (ASNs belonging to the RO TLD), which are responsible for a large portion of the observed attacks. Continue tracking global SSH brute-force trends for any unexpected surges.